HP FlexFabric 5700 Series Security Configuration Manual page 202

Enable NTK (ntkonly mode) to prevent frames from being sent to unknown MAC addresses.
•
Figure 69 Network diagram
Configuration procedure
Make sure the host and the RADIUS server can reach each other.
1. Configure RADIUS authentication/accounting and ISP domain settings. (See
configuration
2. Configure port security:
# Enable port security.
<Device> system-view
[Device] port-security enable
# Use MAC-based accounts for MAC authentication. Each MAC address must be in the
hexadecimal notation with hyphens, and letters are in upper case.
[Device] mac-authentication user-name-format mac-address with-hyphen uppercase
# Specify the MAC authentication domain.
[Device] mac-authentication domain sun
# Set the 802.1X authentication method to CHAP. By default, the authentication method for
802.1X is CHAP.
[Device] dot1x authentication-method chap
# Set port security's limit on the number of MAC addresses to 64 on the port.
[Device] interface ten-gigabitethernet 1/0/1
[Device-Ten-GigabitEthernet1/0/1] port-security max-mac-count 64
# Set the port security mode to macAddressElseUserLoginSecure.
[Device-Ten-GigabitEthernet1/0/1] port-security port-mode
mac-else-userlogin-secure
# Set the NTK mode of the port to ntkonly.
[Device-Ten-GigabitEthernet1/0/1] port-security ntk-mode ntkonly
[Device-Ten-GigabitEthernet1/0/1] quit
Verifying the configuration
# Verify the port security configuration.
[Device] display port-security interface ten-gigabitethernet 1/0/1
Port security parameters:
Port security
AutoLearn aging time
Disableport timeout
MAC move
example.")
: Enabled
: 0 min
: 20 s
: Denied
190
"userLoginWithOUI