MES1000, MES2000 Ethernet Switches
171
5.27
Security functions
5.27.1
Port security functions
For increased security purposes, the switch allows to configure specific ports in such a manner, that
only certain devices could access the switch through this port. Port security function is based on the
permitted MAC address identification. MAC addresses can be configured manually or learned by the
switch. After the required addresses has been learnt, block the port and protect it from packets with
unknown MAC addresses. Thus, when the blocked port receives the packet, and the packet source MAC
address is not related to this port, protection mechanism will be activated, which can take the following
measures: unauthorized packets, coming to the blocked port, will be forwarded, dropped, or the port goes
down. Locked Port security function allows to save the list of learnt MAC addresses into the configuration
file, so this list could be restored after the device is restarted.
There is a restriction on the quantity of learnt MAC addresses for the port protected with
security function. For MES1024/MES1124/MES2124 switches, this restriction equals to 128
addresses per port.
Ethernet interface configuration mode commands (interface range), port group interface
Command line request in Ethernet interface, port group interface configuration mode appears as
follows:
console(config-if)#
Table 5.197 —Ethernet interface configuration mode commands, interface group
Command
Value/Default value
Action
port security max
num
(1..128)/1
Define the maximum address quantity that could be learnt by
the port.
no port security max
Restore the default value.
port security routed
secure-address
mac_address
MAC address format:
H.H.H, H:H:H:H:H:H,
H-H-H-H-H-H
Define the secured MAC address.
no port security routed
secure-address
[
mac_address
]
Remove the secured MAC address.
port security
(1..1000000) seconds
Enable security function for the interface. Block new address
learning function for the interface. Packets with unknown
source MAC addresses will be dropped. This command is
identical to the
port security discard
command.
port security
forward
[
trap
trap
]}
Enable security function for the interface. Block new address
learning function for the interface. Packets with unknown
source MAC addresses will be forwarded.
port security
discard
[
trap
trap
]
Enable security function for the interface. Block new address
learning function for the interface. Packets with unknown
source MAC addresses will be dropped.
port security
discard-
shutdown
[
trap
trap
]
Enable security function for the interface. Disable the port,
when packets with unknown MAC addresses arrive. Packets
with unknown source MAC addresses will be dropped.
port security
trap
trap
Define the SNMP trap message generation frequency, when
unauthorized packets arrive.
no port security
Disable security function for the interface.
port security mode
{max-
addresses | lock}
-/lock
Enable the MAC address learning restriction mode for the
configured interface.
-
max-addresses
—remove the current dynamically learnt
