Filter
Top Products
Chapter 58: MAC Address-based Port Security
840
Overview
This feature lets you control access to the ports on the switch based on
the source MAC addresses of the network devices. You specify the
maximum number of source MAC addresses that ports can learn. Ports
that learn their maximum number of addresses discard packets that have
new, unknown addresses, preventing access to the switch by any further
devices.
As an example, if you configure port 3 on the switch to learn no more than
five source MAC addresses, the port learns up to five address and
forwards the ingress packets of the devices that belong to those
addresses. If the port receives ingress packets that have source MAC
addresses other than the five it has already learned, it discards those
packets to prevent the devices from passing traffic through the switch.
Static Versus
Dynamic
Addresses
The MAC addresses that the ports learn can be stored as either static or
dynamic addresses in the MAC address table in the switch. Ports that
store the addresses as static addresses never learn any new addresses
after they have learned their maximum number. In contrast, ports that
store the addresses as dynamic addresses can learn new addresses
when addresses are timed out from the table by the switch. The addresses
are aged out according to the aging time of the MAC address table.
Note
For background information on the aging time of the MAC address
table, refer to “Overview” on page 316.
Intrusion Actions The intrusion actions define what the switch does when ports that have
learned their maximum number of MAC addresses receive packets that
have unknown source MAC addresses. The possible settings are:
Protect - Ports discard those frames that have unknown MAC
addresses. No other action is taken. For example, if port 14 is
configured to learn 18 addresses, it starts to discard packets with
unknown source MAC addresses after learning 18 MAC
addresses.
Restrict - This is the same as the protect action, except that the
switch sends SNMP traps when the ports discard frames. For
example, if port 12 is configured to learn two addresses, the switch
sends a trap every time the port, after learning two addresses,
discards a packet that has an unknown MAC address.
Shutdown - The switch disables the ports and sends SNMP traps.
For example, if port 5 is configured to learn three MAC addresses,
it is disabled by the switch to prevent it from forwarding any further
traffic if it receives a packet with an unknown source MAC address,