7.8.2 Configuring the Secure Dynamic MAC Function on an
Interface
After port security is enabled on an interface, MAC addresses learned by the interface change
to secure dynamic MAC addresses. When the number of secure dynamic MAC addresses reaches
the limit, the interface does not learn new MAC addresses and allows only the devices with the
learned MAC addresses to communicate with the S7700. You can configure a protection action
for the S7700 to perform when it receives a packet with a new source MAC address.
Context
By default, secure dynamic MAC addresses will not be aged out. Secure dynamic MAC
addresses will be lost after the device restarts and the device needs to learn the MAC addresses
again.
Procedure
Step 1 Run:
system-view
The system view is displayed.
Step 2 Run:
interface interface-type interface-number
The interface view is displayed.
Step 3 Run:
port-security enable
Port security is enabled.
By default, port security is disabled on an interface.
NOTE
You can set the limit on the number of secure dynamic MAC addresses and protection action only when
port security is enabled.
Step 4 (Optional) Run:
port-security max-mac-num max-number
The limit on the number of secure dynamic MAC addresses is set.
By default, the limit on the number of secure dynamic MAC addresses is 1.
Step 5 (Optional) Run:
port-security protect-action { protect | restrict | shutdown }
The protection action is configured.
The default action is restrict.
l protect: discards packets with new source MAC addresses when the number of learned MAC
addresses reaches the limit.
l restrict: discards packets with new source MAC addresses and sends a trap message when
the number of learned MAC addresses exceeds the limit.
Quidway S7700 Smart Routing Switch
Configuration Guide - Ethernet 7 MAC Address Table Configuration
Issue 01 (2011-07-15) Huawei Proprietary and Confidential
Copyright © Huawei Technologies Co., Ltd.
359
To Next Page
Loading...
