HP E3800 Series, Руководство по обеспечению безопасности доступа

Страница: 671 / 732

14-23
Configuring and Monitoring Port Security
MAC Lockdown
MAC Lockdown
MAC Lockdown, also known as “static addressing,” is the permanent assign-
ment of a given MAC address (and VLAN, or Virtual Local Area Network) to
a specific port on the switch. MAC Lockdown is used to prevent station
movement and MAC address hijacking. It also controls address learning on
the switch.
Locking down a MAC address on a port and a specific VLAN only restricts the
MAC address on that VLAN. The client device with that MAC address is
allowed to access other VLANs on the same port or through other ports.
N o t e
Port security and MAC Lockdown are mutually exclusive on a given port. You
can either use port security
or MAC Lockdown, but never both at the same
time on the same port.
You will need to enter a separate command for each MAC/VLAN pair you wish
to lock down. If you do not specify a VLAN ID (VID) the switch inserts a VID
of “1”.
How It Works. When a device’s MAC address is locked down to a port
(typically in a pair with a VLAN) all information sent to that MAC address must
go through the locked-down port. If the device is moved to another port it
cannot receive data. Traffic to the designated MAC address goes only to the
allowed port, whether the device is connected to it or not.
MAC Lockdown is useful for preventing an intruder from “hijacking” a MAC
address from a known user in order to steal data. Without MAC Lockdown,
this will cause the switch to learn the address on the malicious user’s port,
allowing the intruder to steal the traffic meant for the legitimate user.
MAC Lockdown ensures that traffic intended for a specific MAC address can
only go through the one port which is supposed to be connected to that MAC
address. It does not prevent intruders from transmitting packets with the
locked MAC address, but it does prevent responses to those packets from
Syntax: [no] static-mac < mac-addr > vlan < vid > interface < port-number >