HP A5830 Series Configuration Manual page 126

Security switch
Hide thumbs Also See for A5830 Series:
Table of Contents

Advertisement

The output shows that the port security's limit on the number of secure MAC addresses on the port is 64,
the port security mode is autoLearn, intrusion protection traps are enabled, and the intrusion protection
action is disabling the port (DisablePortTemporarily) for 30 seconds.
Use the command repeatedly to track the number of MAC addresses learned by the port, or use the
display this command in Layer 2 Ethernet interface view to display the secure MAC addresses learned:
<Device> system-view
[Device] interface gigabitethernet 1/0/1
[Device-GigabitEthernet1/0/1] display this
#
interface GigabitEthernet1/0/1
port-security max-mac-count 64
port-security port-mode autolearn
port-security mac-address security sticky 0002-0000-0015 vlan 1
port-security mac-address security sticky 0002-0000-0014 vlan 1
port-security mac-address security sticky 0002-0000-0013 vlan 1
port-security mac-address security sticky 0002-0000-0012 vlan 1
port-security mac-address security sticky 0002-0000-0011 vlan 1
#
By issuing the display port-security interface command after the number of MAC addresses learned by
the port reaches 64, you can see that the port security mode has changed to secure. When any frame
with a new MAC address arrives, intrusion protection is triggered, and you see the following traps:
#Jan 14 10:39:47:135 2011 Device PORTSEC/4/VIOLATION:TraphpSecureViolation
An intrusion occurs!
IfIndex: 9437185
Port: 9437185
MAC Addr: 00:02:00:00:00:32
VLAN ID: 1
IfAdminStatus: 1
In addition, you see that the port security feature has disabled the port if you issue the following
command:
[Device-GigabitEthernet1/0/1] display interface gigabitethernet 1/0/1
GigabitEthernet1/0/1 current state:
IP Packet Frame Type: PKTFMT_ETHNT_2, Hardware Address: 000f-cb00-5558
Description: GigabitEthernet1/0/1 Interface
......
The port should be re-enabled 30 seconds later.
[Device-GigabitEthernet1/0/1] display interface gigabitethernet 1/0/1
GigabitEthernet1/0/1 current state: UP
IP Packet Frame Type: PKTFMT_ETHNT_2, Hardware Address: 000f-cb00-5558
Description: GigabitEthernet1/0/1 Interface
......
If you manually delete several secure MAC addresses, the port security mode of the port is restored to
autoLearn, and the port is able to learn MAC addresses again.
Port Security Disabled
118

Advertisement

Table of Contents
loading

Table of Contents