179
•
dot1x
port-control
•
mac-authentication
port-security intrusion-mode
Use
port-security intrusion-mode
to configure the intrusion protection feature so that the port
takes the pre-defined actions when intrusion protection is triggered on the port.
Use
undo port-security intrusion-mode
to restore the default.
Syntax
port-security intrusion-mode
{
blockmac
|
disableport
|
disableport-temporarily
}
undo port-security intrusion-mode
Default
Intrusion protection is disabled.
Views
Layer 2 Ethernet interface view
Default command level
2: System level
Parameters
blockmac
: Adds the source MAC addresses of illegal frames to the blocked MAC address list and
discards frames with blocked source MAC addresses. This implements illegal traffic filtering on the
port. A blocked MAC address is restored to normal after being blocked for 3 minutes, which is fixed
and cannot be changed. To view the blocked MAC address list, use the
display port-security
mac-address block
command.
disableport
: Disables the port permanently upon detecting an illegal frame received on the port.
disableport-temporarily
: Disables the port for a specific period of time whenever it receives an
illegal frame. Use
port-security timer disableport
to set the period.
Usage guidelines
To restore the connection of the port, use the
undo shutdown
command.
Examples
# Configure port GigabitEthernet 3/0/1 to block the source MAC addresses of illegal frames after
intrusion protection is triggered.
<Sysname> system-view
[Sysname] interface gigabitethernet 3/0/1
[Sysname-GigabitEthernet3/0/1] port-security intrusion-mode blockmac
Related commands
•
display
port-security
•
display port-security mac-address block
•
port-security timer disableport
port-security mac-address aging-type inactivity
Use
port-security mac-address aging type inactivity
to enable inactivity aging for secure MAC
addresses (sticky or dynamic).
Use
undo port-security mac-address aging type inactivity
to restore the default.
