Port-Security Mac-Limit - HP FlexNetwork 7500 Series Command Reference Manual

port-security mac-limit

Use port-security mac-limit to set the maximum number of MAC addresses that port security
allows for specific VLANs on a port.
Use undo port-security mac-limit to restore the default.
Syntax
port-security mac-limit max-number per-vlan vlan-id-list
undo port-security mac-limit per-vlan vlan-id-list
Default
The maximum number is 2147483647.
Views
Layer 2 Ethernet interface view
Layer 2 aggregate interface view
Predefined user roles
network-admin
mdc-admin
Parameters
max-number: Specifies the maximum number of MAC addresses. The value range is 1 to
2147483647.
per-vlan vlan-id-list: Applies the maximum number to a VLAN list on per-VLAN basis. The vlan-id-list
argument specifies a space-separated list of up to 10 VLAN items. Each VLAN item specifies a
VLAN by VLAN ID or specifies a range of VLANs in the form of vlan-id1 to vlan-id2. The value range
for the VLAN IDs is 1 to 4094. The value for the vlan-id2 argument must be equal to or greater than
the value for the vlan-id1 argument.
Usage guidelines
This command limits the number of MAC addresses that port security allows to access a port through
specific VLANs. Use this command to prevent resource contentions among MAC addresses and
ensure reliable performance for each access user on the port. When the number of MAC addresses
in a VLAN on the port reaches the upper limit, the device denies any subsequent MAC addresses in
the VLAN on the port.
Port security allows the access of the following types of MAC addresses:
•
MAC addresses that pass MAC authentication or 802.1X authentication.
•
MAC addresses in the MAC authentication guest VSI or MAC authentication critical VSI and
MAC addresses in the MAC authentication guest VLAN or MAC authentication critical VLAN.
•
MAC addresses in the 802.1X guest VSI, 802.1X Auth-Fail VSI, or 802.1X critical VSI and MAC
addresses in the 802.1X guest VLAN, 802.1X Auth-Fail VLAN, or 802.1X critical VLAN.
On a port, the maximum number of MAC addresses in a VLAN cannot be smaller than the number of
existing MAC addresses in the VLAN. If the specified maximum number is smaller, the setting does
not take effect.
Examples
# On Ten-GigabitEthernet 1/0/1, configure VLAN 1, VLAN 5, and VLANs 10 through 20 each to allow
a maximum of 32 MAC authentication and 802.1X users.
<Sysname> system-view
[Sysname] interface ten-gigabitethernet 1/0/1
[Sysname-Ten-GigabitEthernet1/0/1] port-security mac-limit 32 per-vlan 1 5 10 to 20
324