Configuring Secure Mac Addresses; Configuration Prerequisites - HPE FlexNetwork 10500 Series Security Configuration Manual

Configuring secure MAC addresses

Secure MAC addresses are configured or learned in autoLearn mode. If the secure MAC addresses
are saved, they can survive a device reboot. You can bind a secure MAC address only to one port in
a VLAN.
Secure MAC addresses include static, sticky, and dynamic secure MAC addresses.
Table 18 Comparison of static, sticky, and dynamic secure MAC addresses
Type Address sources
Manually added (by using
the port-security
Static mac-address security
command without the
sticky keyword).
•
•
Sticky
•
•
•
Dynamic
When the maximum number of secure MAC address entries is reached, the port changes to secure
mode. In secure mode, the port cannot add or learn any more secure MAC addresses. The port
allows only frames sourced from secure MAC addresses or MAC addresses configured by using the
mac-address dynamic or mac-address static command to pass through.

Configuration prerequisites

Before you configure secure MAC addresses, complete the following tasks:
•
Enable port security.
•
Set port security's limit on the number of MAC addresses on the port. Perform this task before
you enable autoLearn mode.
•
Set the port security mode to autoLearn.
Manually added (by
using the
port-security
mac-address security
command with the
sticky keyword).
Converted from
dynamic secure MAC
addresses.
Automatically learned
when the dynamic
secure MAC feature is
disabled.
Converted from sticky
MAC addresses.
Automatically learned
after the dynamic
secure MAC feature is
enabled.
Aging mechanism
Not available.
The static secure MAC addresses
never age out unless you perform any
of the following tasks:
•
Manually remove these MAC
addresses.
•
Change the port security mode.
•
Disable the port security feature.
By default, sticky MAC addresses do
not age out. However, you can
configure an aging timer or use the
aging timer together with the inactivity
aging feature to remove old sticky MAC
addresses.
•
If only the aging timer is
configured, the aging timer counts
up regardless of whether traffic
data has been sent from the sticky
MAC addresses.
•
If both the aging timer and the
inactivity aging feature are
configured, the aging timer restarts
once traffic data is detected from
the sticky MAC addresses.
Same as sticky MAC addresses.
248
Can be saved and
survive a device
reboot?
Yes.
Yes.
The secure MAC
aging timer restarts at
a reboot.
No.
All dynamic secure
MAC addresses are
lost at reboot.