HP 4500G PWR 24-Port, Руководство по настройке

Страница: 1309 / 1968

1-7
Configuring Procedure
Follow these steps to enable any other port security mode:
To do… Use the command… Remarks
Enter system view
system-view
—
Set an OUI value for
user authentication
port-security oui oui-value index
index-value
Optional
Not configured by default.
The command is required for
the
userlogin-withoui
mode.
Enter interface view
interface interface-type
interface-number
—
Set the port security
mode
port-security port-mode
{
autolearn |
mac-authentication |
mac-else-userlogin-secure |
mac-else-userlogin-secure-ext |
secure | userlogin | userlogin-secure
| userlogin-secure-ext |
userlogin-secure-or-mac |
userlogin-secure-or-mac-ext |
userlogin-withoui
}
Required
By default, a port operates in
noRestrictions mode.
z
You cannot change the maximum number of secure MAC addresses allowed on a port that
operates in autoLearn mode.
z
OUI, defined by IEEE, is the first 24 bits of the MAC address and uniquely identifies a device
vendor.
z
You can configure multiple OUI values. However, a port in userLoginWithOUI mode allows only
one 802.1X user and one user whose MAC address contains a specified OUI.
z
After enabling port security, you can change the port security mode of a port only when the port is
operating in noRestrictions mode, the default mode. To change the port security mode of a port
operating in any other mode, use the
undo port-security port-mode
command to restore the
default port security mode at first.
z
You cannot change the port security mode of a port with users online.
Configuring Port Security Features
Configuring NTK
The need to know (NTK) feature checks the destination MAC addresses in outbound frames to allow
frames to be forwarded to only devices passing authentication. The NTK feature supports three modes:
z
ntkonly
: Forwards only frames destined for authenticated MAC addresses.
z
ntk-withbroadcasts
: Forwards only frames destined for authenticated MAC addresses or the
broadcast address.
z
ntk-withmulticasts
: Forwards only frames destined for authenticated MAC addresses, multicast
addresses, or the broadcast address.