User’s Guide FUJITSU PSWITCH
December/2018 55
The user specifies the maximum number of dynamic MAC addresses that can be
learned on a port. The Maximum number of MAC addresses is
platform-dependent and is given in the software release notes. After the limit
is reached, additional MAC addresses are not learned. Only frames with an
allowable source MAC address are forwarded.
Static Locking:
The user manually specifies a list of static MAC addresses for a port.
Dynamically locked addresses can be converted to statically locked addresses.
Dynamic locking implements a 'first arrival' mechanism for Port Security. The user
specifies how many addresses can be learned on the locked port. If the limit has
not been reached, then a packet with an unknown source MAC address is learned
and forwarded normally. Once the limit is reached, no more addresses are learned
on the port. Any packets with source MAC addresses that were not already learned
are discarded. Note that the user can effectively disable dynamic locking by setting
the number of allowable dynamic entries to zero.
Static locking allows the user to specify a list of MAC addresses that are allowed on
a port. The behavior of packets is the same as for dynamic locking: only packets
with an allowable source MAC address can be forwarded. Note that the user is
allowed to take all of the dynamically locked MAC addresses on a port and move
them to a static state.
Port Security helps secure the network by preventing unknown devices from
forwarding packets into the network. The user can lock down a port, and only a
specified number of addresses can be learned on that port. For instance, if the
users want to ensure that only a single device can be active on a port, they can set
the number of allowable dynamic addresses to one. After the MAC address of the
first device is learned, no other devices are allowed to forward frames into the
network.
When link goes down on a port, all of the dynamically locked addresses are 'freed'.
That is, when link is restored, that port can once again learn addresses up to the
user specified limit.
If the users know the specific MAC address (or addresses) that exists off of a
particular port, they can specify those addresses as allowable. By setting the
number of allowable dynamic entries to zero, only packets with a source MAC
address matching a MAC address in the static list can be forwarded.
A dynamically locked MAC address is eligible to be aged out if another packet with
that MAC address is not seen within the age-out time. Dynamically locked MAC
addresses are also eligible to be relearned on another port if a station movement
occurs. Statically locked MAC addresses are not eligible for aging. If a packet comes
in on a port with a MAC address that is statically locked on another port, then that
To Next Page
Loading...
Need help?
General
