HP E3800 Series, Руководство по обеспечению безопасности доступа

Страница: 681 / 732

14-33
Configuring and Monitoring Port Security
Port Security and MAC Lockout
If someone using a locked out MAC address tries to send data through the
switch a message similar to the following is generated in the log file:
Lockout logging format:
W 10/30/03 21:35:15 maclock: module A: 0001e6-1f96c0
detected on port A15
W 10/30/03 21:35:18 maclock: module A: 0001e6-1f96c0
detected on port A15
W 10/30/03 21:35:18 maclock: module A: Ceasing lock-out
logs for 5m
As with MAC Lockdown a rate limiting algorithm is used on the log file so that
it does not become overclogged with error messages. (Refer to “Limiting the
Frequency of Log Messages” on page 14-26.)
Port Security and MAC Lockout
MAC Lockout is independent of port-security and in fact will override it. MAC
Lockout is preferable to port-security to stop access from known devices
because it can be configured for all ports on the switch with one command.
It is possible to use MAC Lockout in conjunction with port-security. You can
use MAC Lockout to lock out a single address—deny access to a specific
device—but still allow the switch some flexibility in learning other MAC
Addresses. Be careful if you use both together, however:
• If a MAC Address is locked out and appears in a static learn table in
port-security, the apparently “authorized” address will still be locked
out anyway.
• MAC entry configurations set by port security will be kept even if MAC
Lockout is configured and the original port security settings will be
honored once the Lockout is removed.
• A port security static address is permitted to be a lockout address. In
that case (MAC Lockout), the address will be locked out (SA/DA drop)
even though it’s an “authorized” address from the perspective of port
security.
• When MAC Lockout entries are deleted, port security will then re-
learn the address as needed later on.