172
MES1000, MES2000 Ethernet Switches
addresses, related to this interface. Learning of address
maximum quantity for the port is enabled. Repeated learning
and ageing is enabled.
-
lock
—save the current dynamically learnt addresses related
to the interface into the file and deny the new address
learning and the ageing of the already learnt addresses.
no port security mode
Restore the default value.
EXEC mode commands
Command line request in EXEC mode appears as follows:
console>
Table 5.198 —EXEC mode commands
Command
Value
Action
show
ports
security
{
gigabitethernet
gi_port
|
fastethernet
fa_port
|port-
channel
group
}
gi_port: (1..3/0/1..28);
fa_port: (1..3/0/1..24);
group: (1..8)
Show security function settings for the selected interface.
show
ports
security
addresses
{
gigabitethernet
gi_port
|
fastethernet
fa_port
|port-
channel
group
}
gi_port: (1..3/0/1..28);
fa_port: (1..3/0/1..24);
group: (1..8)
Show the current dynamic addresses for the blocked ports.
set
interface
active
{
gigabitethernet
gi_port
|
fastethernet
fa_port
|port-
channel
group
}
gi_port: (1..3/0/1..28);
fa_port: (1..3/0/1..24);
group: (1..8)
Activate the interface, disabled by the port security function
(this command is available to privileged users only).
Example execution of commands
Enable security function for Ethernet interface 15. Set the port learning restriction for port 1.
After the MAC address has been learnt, block the new address learning function for the
interface and drop packets with unknown source MAC address. Save learnt address into file.
console#
configure
console(config)#
interface gigabitethernet
1/0/15
console(config-if)#
port security max
1
Connect the client to port and learn the MAC address.
console(config-if)#
port security
discard
console(config-if)#
port security mode lock
5.27.2
Port-based client authentication (802.1x standard)
5.27.2.1
Basic authentication
Authentication based on 802.1x standard enables authentication of switch users via the external
server using the port, that the client is connected to. Only authenticated and authorized users will be able
to send and receive the data. Port user authentication is performed by RADIUS server and EAP (Extensible
Authentication Protocol).
Global configuration mode commands
Command line request in global configuration mode appears as follows:
console(config)#
