Configuring Secure Mac Addresses - HP FlexNetwork 10500 Series Security Configuration Manual

Step
5. (Optional.) Set the silence
timeout period during which
a port remains disabled.
NOTE:
On a port operating in either macAddressElseUserLoginSecure mode or
macAddressElseUserLoginSecureExt mode, intrusion protection is triggered only after both MAC
authentication and 802.1X authentication fail for the same frame.

Configuring secure MAC addresses

Secure MAC addresses are configured or learned in autoLearn mode. If the secure MAC addresses
are saved, they can survive a device reboot. You can bind a secure MAC address only to one port in
a VLAN.
Secure MAC addresses include static, sticky, and dynamic secure MAC addresses.
Table 15 A comparison of static, sticky, and dynamic secure MAC addresses
Type Address sources
Manually added (by using
the port-security
Static mac-address security
command without the
sticky keyword).
•
Sticky
•
•
•
•
Dynamic
Command
port-security timer disableport
time-value
Manually added (by
using the
port-security
mac-address
security command
with the sticky
keyword).
Converted from
dynamic secure MAC
addresses.
Automatically learned
when the dynamic
secure MAC feature is
disabled.
Converted from sticky
MAC addresses.
Automatically learned
after the dynamic
secure MAC feature is
enabled.
Aging mechanism
Not available.
The static secure MAC addresses
never age out unless you perform any
of the following tasks:
•
Manually remove these MAC
addresses.
•
Change the port security mode.
•
Disable the port security feature.
By default, sticky MAC addresses do
not age out. However, you can
configure an aging timer or use the
aging timer together with the inactivity
aging feature to remove old sticky MAC
addresses.
•
If only the aging timer is
configured, the aging timer counts
up regardless of whether traffic
data has been sent from the sticky
MAC addresses.
•
If both the aging timer and the
inactivity aging feature are
configured, the aging timer
restarts once traffic data is
detected from the sticky MAC
addresses.
Same as sticky MAC addresses.
199
Remarks
By default, the port silence
timeout is 20 seconds.
Can be saved and
survive a device
reboot?
Yes.
Yes.
The secure MAC
aging timer restarts at
a reboot.
No.
All dynamic secure
MAC addresses are
lost at reboot.