Security Commands
ExtremeWare XOS 11.5 supports only the Summit X450 family of switches and the BlackDiamond 8800 series switch.
ExtremeWare XOS 11.5 Command Reference Guide
956
For ports that have a learning limit in place, the following traffic still flows to the port:
●
Packets destined for permanent MACs and other non-blackholed MACs
●
Broadcast traffic
●
EDP traffic
Traffic from the permanent MAC and any other non-blackholed MACs will still flow from the virtual
port.
If you configure a MAC address limit on VLANS that participate in an Extreme Standby Router
Protocol (ESRP) domain, you should add an additional back-to-back link (that has no MAC address
limit on these ports) between the ESRP-enabled switches. Doing so prevents ESRP protocol data units
(PDUs) from being dropped due to MAC address limit settings.
Port lockdown.
The port lockdown feature allows you to prevent any additional learning on the virtual
port, keeping existing learned entries intact. This is equivalent to making the dynamically-learned
entries permanent static, and setting the learning limit to zero. All new source MAC addresses are
blackholed.
Locked entries do not get aged, but can be deleted like any other permanent FDB entries. The maximum
number of permanent lockdown entries is 1024. Any FDB entries above will be flushed and blackholed
during lockdown.
For ports that have lockdown in effect, the following traffic still flows to the port:
●
Packets destined for the permanent MAC and other non-blackholed MACs
●
Broadcast traffic
●
EDP traffic
Traffic from the permanent MAC will still flow from the virtual port.
Once the port is locked down, all the entries become permanent and will be saved across reboot.
When you remove the lockdown using the unlock-learning option, the learning-limit is reset to
unlimited, and all associated entries in the FDB are flushed.
To display the locked entries on the switch, use the following command:
show fdb
Locked MAC address entries have the “l” flag.
To verify the MAC security configuration for the specified VLAN or ports, use the following
commands:
show vlan <vlan name> security
show ports <portlist> info detail
Example
The following command limits the number of MAC addresses that can be learned on ports 1, 2, 3, and 6
in a VLAN named
accounting
, to 128 addresses:
configure ports 1, 2, 3, 6 vlan accounting learning-limit 128
