HP 3600 v2 Series Configuration Manual page 222
Hide thumbs
Also See for 3600 v2 Series:
- Command reference manual (510 pages) ,
- Configuration manual (441 pages) ,
- Security configuration manual (398 pages)
Table of Contents
Advertisement
The output shows that the port security's limit on the number of secure MAC addresses on the port is 64,
the port security mode is autoLearn, intrusion protection traps are enabled, and the intrusion protection
action is disabling the port (DisablePortTemporarily) for 30 seconds.
# Repeatedly perform the display port-security command to track the number of MAC addresses learned
by the port, or use the display this command in Layer 2 Ethernet interface view to display the secure MAC
addresses.
<Device> system-view
[Device] interface ethernet 1/0/1
[Device-Ethernet1/0/1] display this
#
interface Ethernet1/0/1
port-security max-mac-count 64
port-security port-mode autolearn
port-security mac-address security sticky 0002-0000-0015 vlan 1
port-security mac-address security sticky 0002-0000-0014 vlan 1
port-security mac-address security sticky 0002-0000-0013 vlan 1
port-security mac-address security sticky 0002-0000-0012 vlan 1
port-security mac-address security sticky 0002-0000-0011 vlan 1
#
Execute the display port-security interface command after the number of MAC addresses learned by the
port reaches 64, and you can see that the port security mode has changed to secure. When any frame
with a new MAC address arrives, intrusion protection is triggered and you can see the following trap
message.
#Jan 14 10:39:47:135 2011 Device PORTSEC/4/VIOLATION: Trap1.3.6.1.4.1.25506.2.26.1.
3.2<hhpSecureViolation>:
An intrusion occurs!
IfIndex: 9437185
Port: 9437185
MAC Addr: 00:02:00:00:00:32
VLAN ID: 1
IfAdminStatus: 1
# Execute the display interface command, and can see that the port security feature has disabled
the port.
[Device-Ethernet1/0/1] display interface ethernet 1/0/1
Ethernet1/0/1 current state: DOWN (
IP Packet Frame Type: PKTFMT_ETHNT_2, Hardware Address: 000f-cb00-5558
Description: Ethernet1/0/1 Interface
......
The port should be re-enabled 30 seconds later.
[Device-Ethernet1/0/1] display interface ethernet 1/0/1
Ethernet1/0/1 current state: UP
IP Packet Frame Type: PKTFMT_ETHNT_2, Hardware Address: 000f-cb00-5558
Description: Ethernet1/0/1 Interface
......
Delete several secure MAC addresses, and you can see that the port security mode of the
port changes to autoLearn, and the port can learn MAC addresses again.
Port Security Disabled
209
)
Advertisement
Table of Contents
Troubleshooting
