Enabling Port Security Traps; Configuring Secure Mac Addresses - HP A5830 Series Configuration Manual

To do...
1. Enter system view.
2. Enter Layer 2 Ethernet
interface view.
3. Configure the intrusion
protection feature.
4. Return to system view.
5. Set the silence timeout period
during which a port remains
disabled.

Enabling port security traps

You can configure the port security module to send traps for the following categories of events:
addresslearned—Learning of new MAC addresses.
•
dot1xlogfailure/dot1xlogon/dot1xlogoff—802.1X authentication failure, success, and 802.1X user
•
logoff.
ralmlogfailure/ralmlogon/ralmlogoff—MAC authentication failure, MAC authentication user logon,
•
and MAC authentication user logoff.
intrusion—Detection of illegal frames.
•
To enable port security traps:
To do...
1. Enter system view.
2. Enable port security traps.

Configuring secure MAC addresses

Secure MAC addresses are MAC addresses configured or learned in autoLearn mode. They can survive
link down/up events, and once saved, can survive a device reboot. You can bind a MAC address to
only one port in a VLAN.
Secure MAC addresses fall into static secure MAC addresses and sticky MAC addresses.
Static secure MAC addresses are manually configured at the command line or in the MIB in autoLearn
mode. No aging mechanism is available for this type of MAC address. They never age out unless you
manually remove them, change the port security mode, or disable the port security feature.
Sticky MAC addresses include dynamic secure MAC addresses manually configured at the command
line interface or in the MIB, and dynamic secure MAC addresses learned by a port in autoLearn mode.
These MAC addresses are sticky because unlike normal dynamic MAC addresses, they can survive link
down/up events, and once saved, can survive a device reboot.
Use the command...
system-view
interface interface-type interface-
number
port-security intrusion-mode {
blockmac | disableport |
disableport-temporarily }
quit
port-security timer disableport
time-value
Use the command...
system-view
port-security trap {
addresslearned | dot1xlogfailure
| dot1xlogoff | dot1xlogon |
intrusion | ralmlogfailure |
ralmlogoff | ralmlogon }
114
Remarks
—
—
Required.
By default, intrusion protection is
disabled.
—
Optional.
20 seconds by default.
Remarks
—
Required.
By default, port security traps are
disabled.