Table of Contents
Advertisement
Keyword
userlogin-secure-or-
mac
userlogin-secure-or-
mac-ext
userlogin-withoui
NOTE:
The autolearn, secure, and userlogin-withoui keywords are not supported on Layer 2 aggregate
interfaces.
Usage guidelines
To change the security mode for a port security enabled port, you must set the port in noRestrictions
mode first. Do not change port security mode when the port has online users.
IMPORTANT:
If you are configuring the autoLearn mode, first set port security's limit on the number of secure MAC
addresses by using the port-security max-mac-count command. You cannot change the setting
when the port is operating in autoLearn mode.
When port security is enabled, you cannot enable 802.1X or MAC authentication, or change the
access control mode or port authorization state. The port security automatically modifies these
settings in different security modes.
As
a
best
mac-else-userlogin-secure-ext mode on the port where MAC authentication delay is enabled. The
two modes are mutually exclusive with the MAC authentication delay feature. For more information
about MAC authentication delay, see "MAC authentication commands."
Examples
# Enable port security, and set Ten-GigabitEthernet 1/0/1 to operate in secure mode.
Security mode
macAddressOrUserL
oginSecure
macAddressOrUserL
oginSecureExt
userLoginWithOUI
practice,
do
not
Description
This mode is the combination of the userLoginSecure
and macAddressWithRadius modes. In this mode, the
port allows one 802.1X authentication user and multiple
MAC authentication users to log in.
In this mode, the port performs 802.1X authentication
first. By default, if 802.1X authentication fails, MAC
authentication is performed.
However, the port in this mode processes authentication
differently when the following conditions exist:
•
The port is enabled with parallel processing of MAC
authentication and 802.1X authentication.
•
The port is enabled with the 802.1X unicast trigger.
•
The port receives a packet from an unknown MAC
address.
Under such conditions, the port sends a unicast
EAP-Request/Identity packet to the MAC address to
initiate 802.1X authentication. After that, the port
immediately processes MAC authentication without
waiting for the 802.1X authentication result.
Same as the macAddressOrUserLoginSecure mode,
except that a port in this mode supports multiple 802.1X
and MAC authentication users.
Similar to the userLoginSecure mode. In addition, a port
in this mode also permits frames from a user whose MAC
address contains a specific OUI.
In this mode, the port performs OUI check at first. If the
OUI check fails, the port performs 802.1X authentication.
The port permits frames that pass OUI check or 802.1X
authentication.
enable
the
mac-else-userlogin-secure
331
or
Advertisement
Table of Contents
