Configuring Intrusion Protection - HP A6600 Configuration Manual

ntkonly—Forwards only unicast frames with authenticated destination MAC addresses.
•
ntk-withbroadcasts—Forwards only broadcast frames and unicast frames with authenticated
•
destination MAC addresses.
ntk-withmulticasts—Forwards only broadcast frames, multicast frames, and unicast frames with
•
authenticated destination MAC addresses.
To configure the NTK feature:
To do...
1. Enter system view.
2. Enter interface view.
3. Configure the NTK feature.
NOTE:
This feature is available only on a SAP interface card in bridging mode.

Configuring intrusion protection

The intrusion protection enables a device to take one of the following actions in response to illegal
frames:
blockmac—Adds the source MAC addresses of illegal frames to the blocked MAC addresses list
•
and discards the frames. All subsequent frames sourced from a blocked MAC address are
dropped. A blocked MAC address is restored to the normal state after being blocked for 3 minutes.
The interval is fixed and cannot be changed.
disableport—Disables the port until you bring it up manually.
•
disableport-temporarily—Disables the port for a specified period of time. The period can be
•
configured with port-security timer disableport.
To configure the intrusion protection feature:
To do...
1. Enter system view.
2. Enter interface view.
3. Configure the intrusion
protection feature.
4. Return to system view.
5. Set the silence timeout period
during which a port remains
disabled.
Command...
system-view
interface interface-type interface-
number
port-security ntk-mode { ntk-
withbroadcasts | ntk-
withmulticasts | ntkonly }
Command...
system-view
interface interface-type interface-
number
port-security intrusion-mode {
blockmac | disableport |
disableport-temporarily }
quit
port-security timer disableport
time-value
180
Remarks
—
—
Required.
By default, NTK is disabled on a
port, and all frames are allowed
to be sent.
Remarks
—
—
Required.
By default, intrusion protection is
disabled.
—
Optional.
20 seconds by default.