180
•
ntkonly
—Forwards only unicast frames with authenticated destination MAC addresses.
•
ntk-withbroadcasts
—Forwards only broadcast frames and unicast frames with authenticated
destination MAC addresses.
•
ntk-withmulticasts
—Forwards only broadcast frames, multicast frames, and unicast frames with
authenticated destination MAC addresses.
To configure the NTK feature:
To do…
Command…
Remarks
1.
Enter system view.
system-view
—
2.
Enter interface view.
interface
interface-type interface-
number
—
3.
Configure the NTK feature.
port-security ntk-mode
{
ntk-
withbroadcasts
|
ntk-
withmulticasts
|
ntkonly
}
Required.
By default, NTK is disabled on a
port, and all frames are allowed
to be sent.
NOTE:
This feature is available only on a SAP interface card in bridging mode.
Configuring intrusion protection
The intrusion protection enables a device to take one of the following actions in response to illegal
frames:
•
blockmac
—
Adds the source MAC addresses of illegal frames to the blocked MAC addresses list
and discards the frames. All subsequent frames sourced from a blocked MAC address are
dropped. A blocked MAC address is restored to the normal state after being blocked for 3 minutes.
The interval is fixed and cannot be changed.
•
disableport
—Disables the port until you bring it up manually.
•
disableport-temporarily
—Disables the port for a specified period of time. The period can be
configured with
port-security timer disableport.
To configure the intrusion protection feature:
To do…
Command…
Remarks
1.
Enter system view.
system-view
—
2.
Enter interface view.
interface
interface-type interface-
number
—
3.
Configure the intrusion
protection feature.
port-security intrusion-mode
{
blockmac
|
disableport
|
disableport-temporarily
}
Required.
By default, intrusion protection is
disabled.
4.
Return to system view.
quit
—
5.
Set the silence timeout period
during which a port remains
disabled.
port-security timer
disableport
time-value
Optional.
20 seconds by default.
