Chapter 52: MAC Address-based Port Security
698 Section VIII: Port Security
Overview
This feature lets you control access to the ports on the switch based on
the source MAC addresses of the network devices. You specify the
maximum number of source MAC addresses that ports can learn. Ports
that learn their maximum number of addresses discard packets that have
new, unknown addresses, preventing access to the switch by any further
devices.
As an example, if you configure port 3 on the switch to learn no more than
five source MAC addresses, the port learns up to five address and
forwards the ingress packets of the devices that belong to those
addresses. If the port receives ingress packets that have source MAC
addresses other than the five it has already learned, it discards those
packets to prevent the devices from passing traffic through the switch.
Static Versus
Dynamic
Addresses
The MAC addresses that the ports learn can be stored as either static or
dynamic addresses in the MAC address table in the switch. Ports that
store the addresses as static addresses never learn any new addresses
after they have learned their maximum number. In contrast, ports that
store the addresses as dynamic addresses can learn new addresses
when addresses are timed out from the table by the switch. The addresses
are aged out according to the aging time of the MAC address table.
Note
For background information on the aging time of the MAC address
table, refer to “Overview” on page 258.
Intrusion Actions The intrusion actions define what the switch does when ports that have
learned their maximum number of MAC addresses receive packets that
have unknown source MAC addresses. The possible settings are:
Protect - Ports discard those frames that have unknown MAC
addresses. No other action is taken. For example, if port 14 is
configured to learn 18 addresses, it starts to discard packets with
unknown source MAC addresses after learning 18 MAC addresses.
Restrict - This is the same as the protect action, except that the switch
sends SNMP traps when the ports discard frames. For example, if port
12 is configured to learn two addresses, the switch sends a trap every
time the port, after learning two addresses, discards a packet that has
an unknown MAC address.
Shutdown - The switch disables the ports and sends SNMP traps. For
example, if port 5 is configured to learn three MAC addresses, it is
disabled by the switch to prevent it from forwarding any further traffic if
it receives a packet with an unknown source MAC address, after
learning three addresses. The switch also sends an SNMP trap.
To Next Page
Loading...
