Huawei quidway s7700 - Example for Configuring Interface Security

Data Preparation
To complete the configuration, you need the following data:
l Name of the VSI: huawei
l Maximum number of learned MAC addresses: 300
Procedure
Step 1 Create a VSI.
# Create a VSI named huawei.
<Quidway> system-view
[Quidway] vsi huawei static
Step 2 Configure the limitation on MAC address learning in the VSI.
# Configure the rule of limiting MAC address learning for the VSI: A maximum of 300 MAC
addresses can be learned; extra packets are directly discarded and alarms are generated.
[Quidway-vsi-huawei] mac-limit maximum 300 action discard alarm enable
[Quidway-vsi-huawei] quit
Step 3 Verify the configuration.
# Run the display mac-limit command in any view. You can check whether the rule of limiting
MAC address learning is successfully configured.
<Quidway> display mac-limit
MAC Limit is enabled
Total MAC Limit rule count : 1
PORT VLAN/VSI/SI SLOT Maximum Rate(ms) Action Alarm
----------------------------------------------------------------------------
- huawei - 300 - discard enable
----End
Configuration Files
The following lists the configuration file of the Switch.
#
sysname Quidway
#
vsi huawei static
mac-limit maximum 300
#
return
7.14.4 Example for Configuring Interface Security
Networking Requirements
As shown in Figure 7-9, a company wants to prevent the computers of non-employees from
accessing the intranet of the company to protect information security. To achieve this goal, the
company needs to enable the sticky MAC function on the interface connected to computers of
employees and set the maximum number of MAC addresses learned by the interface to be the
same as the number of trusted computers.
Quidway S7700 Smart Routing Switch
Configuration Guide - Ethernet 7 MAC Address Table Configuration
Issue 01 (2011-07-15) Huawei Proprietary and Confidential
Copyright © Huawei Technologies Co., Ltd.
375