82
macAddressWithRadius: A port in this mode performs MAC authentication, and services
multiple users.
•
Perform a combination of MAC authentication and 802.1X authentication:
{
macAddressOrUserLoginSecure.
This mode is the combination of the macAddressWithRadius and userLoginSecure modes.
The mode allows one 802.1X authentication user and multiple MAC authentication users to
log in.
In this mode, the port performs 802.1X authentication first. If 802.1X authentication fails,
MAC authentication is performed.
{
macAddressOrUserLoginSecureExt.
This mode is similar to the macAddressOrUserLoginSecure mode, except that this mode
supports multiple 802.1X and MAC authentication users.
{
macAddressElseUserLoginSecure.
This mode is the combination of the macAddressWithRadius and userLoginSecure modes,
with MAC authentication having a higher priority as the
Else
keyword implies. The mode
allows one 802.1X authentication user and multiple MAC authentication users to log in.
In this mode, the port performs MAC authentication upon receiving non-802.1X frames.
Upon receiving 802.1X frames, the port performs MAC authentication and then, if the
authentication fails, 802.1X authentication.
{
macAddressElseUserLoginSecureExt.
This mode is similar to the macAddressElseUserLoginSecure mode except that this mode
supports multiple 802.1X and MAC authentication users as the
Ext
keyword implies.
Port security features
Intrusion protection mode
The intrusion protection feature checks the source MAC addresses in inbound frames for illegal
frames, and takes one of the following actions in response to illegal frames:
•
Block
MAC
—Adds the source MAC addresses of illegal frames to the blocked MAC address
list and discards the frames. All subsequent frames sourced from a blocked MAC address are
dropped. A blocked MAC address is restored to normal state after being blocked for 3 minutes.
The interval is fixed and cannot be changed.
•
Disable
port
—Disables the port until you bring it up manually.
•
Disable
port
temporarily
—Disables the port for a period of time. The silence period is user
configurable.
NTK mode
The NTK feature checks the destination MAC addresses in outbound frames to make sure frames
are forwarded only to authenticated devices.
The NTK feature supports the following modes:
•
ntkonly
—Forwards only unicast frames with authenticated destination MAC addresses.
•
ntk-withbroadcasts
—Forwards only broadcast frames and unicast frames with authenticated
destination MAC addresses.
•
ntk-withmulticasts
—Forwards only broadcast frames, multicast frames, and unicast frames
with authenticated destination MAC addresses.
The NTK feature drops any unicast frame with an unknown destination MAC address.
