HP 3600 v2 Series Security Configuration Manual page 213

A port in this mode can learn MAC addresses, and allows frames from learned or configured MAC
addresses to pass. The automatically learned MAC addresses are secure MAC addresses. You can also
configure secure MAC addresses by using the port-security mac-address security command. A secure
MAC address never ages out by default.
When the number of secure MAC addresses reaches the upper limit, the port transitions to secure mode.
The dynamic MAC address learning function in MAC address management is disabled on ports
operating in autoLearn mode, but you can configure MAC addresses by using the mac-address dynamic
and mac-address static commands.
secure
2.
MAC address learning is disabled on a port in secure mode. You configure MAC addresses by using the
mac-address static and mac-address dynamic commands. For more information about configuring MAC
address table entries, see Layer 2—LAN Switching Configuration Guide.
A port in secure mode allows only frames sourced from secure MAC addresses and manually configured
MAC addresses to pass.
Performing 802.1X authentication
userLogin
1.
A port in this mode performs 802.1X authentication and implements port-based access control. The port
can service multiple 802.1X users. If one 802.1X user passes authentication, all the other 802.1X users of
the port can access the network without authentication.
userLoginSecure
2.
A port in this mode performs 802.1X authentication and implements MAC-based access control. The port
services only one user passing 802.1X authentication.
userLoginSecureExt
3.
This mode is similar to the userLoginSecure mode except that this mode supports multiple online 802.1X
users.
userLoginWithOUI
4.
This mode is similar to the userLoginSecure mode. The difference is that a port in this mode also permits
frames from one user whose MAC address contains a specific organizationally unique identifier (OUI).
For wired users, the port performs 802.1X authentication upon receiving 802.1X frames, and performs
OUI check upon receiving non-802.1X frames.
Performing MAC authentication
macAddressWithRadius: A port in this mode performs MAC authentication and services multiple users.
Performing a combination of MAC authentication and 802.1X authentication
macAddressOrUserLoginSecure
1.
This mode is the combination of the macAddressWithRadius and userLoginSecure modes.
For wired users, the port performs MAC authentication upon receiving non-802.1X frames and performs
802.1X authentication upon receiving 802.1X frames.
macAddressOrUserLoginSecureExt
2.
This mode is similar to the macAddressOrUserLoginSecure mode except that a port in this mode supports
multiple 802.1X and MAC authentication users.
macAddressElseUserLoginSecure
3.
202