Extreme Networks ExtremeWare XOS 11.3, Руководство пользователя

Страница: 253 / 698

MAC-Based Security
ExtremeWare XOS 11.3 Concepts Guide
253
NOTE
This netlogin parameter applies only for the Summit X450 switch and the BlackDiamond 8800 family of switches.
See
Chapter 17 for more information on netlogin
●
permanent
—Displays all permanent entries, including the ingress and egress QoS profiles.
●
ports <portlist>
—Displays the entries for a set of ports or slots and ports.
●
vlan <vlan name>
—Displays the entries for a VLAN.
●
stats
—Displays the number of static, permanent, dynamic, and dropped entries; as well as the
aging time.
With no options, the command displays all FDB entries. (The age parameter does not show on the
display for the backup MSM on modular switches; it
does show on the display for the primary MSM.)
MAC-Based Security
MAC-based security allows you to control the way the FDB is learned and populated. By managing
entries in the FDB, you can block and control packet flows on a per-address basis.
MAC-based security allows you to limit the number of dynamically-learned MAC addresses allowed
per virtual port. You can also “lock” the FDB entries for a virtual port, so that the current entries will
not change, and no additional addresses can be learned on the port.
You can also prioritize or stop packet flows based on the source MAC address of the ingress VLAN or
the destination MAC address of the egress VLAN.
NOTE
For detailed information about MAC-based security, see Chapter 16 .
This section covers the following topics:
●
Disabling MAC Address Learning on page 253
●
Disabling Egress Flooding on page 254
●
Displaying Learning and Flooding Settings on page 256
Disabling MAC Address Learning
By default, MAC address learning is enabled on all ports. You disable learning on specified ports using
the following command:
disable learning port [<port_list> | all]
If MAC address learning is disabled, only broadcast traffic, EDP traffic, and packets destined to a
permanent MAC address matching that port number, are forwarded. Use this command in a secure
environment where access is granted via permanent FDBs per port. Disabling learning on a port causes
the MAC addresses to flood (unless you disable egress flooding) because those addresses will not be
present in the FDB during a destination lookup.