HP ProCurve 9304M Security Manual page 119

Using the MAC Port Security Feature
To set the port security age timer to 10 minutes on a specific interface:
ProCurveRS(config)# int e 7/11
ProCurveRS(config-if-e100-7/11)# port security
ProCurveRS(config-port-security-e100-7/11)# age 10
Syntax: [no] age <minutes>
The default is 0 (never age out secure MAC addresses).
Specifying Secure MAC Addresses
To specify a secure MAC address on an interface, enter commands such as the following:
ProCurveRS(config)# int e 7/11
ProCurveRS(config-if-e100-7/11)# port security
ProCurveRS(config-port-security-e100-7/11)# secure 0050.DA18.747C
Syntax: [no] secure <mac-address>
Autosaving Secure MAC Addresses to the Startup-Config File
The learned MAC addresses can automatically be saved to the startup-config file at specified intervals. For
example, to automatically save learned secure MAC addresses on the device every twenty minutes, enter the
following commands:
ProCurveRS(config)# port security
ProCurveRS(config-port-security)# autosave 20
Syntax: [no] autosave <minutes>
You can specify from 15 – 1440 minutes. By default, secure MAC addresses are not autosaved to the startup­
config file.
Specifying the Action Taken when a Security Violation Occurs
A security violation can occur when a user tries to plug into a port where a MAC address is already locked, or the
maximum number of secure MAC addresses has been exceeded. When a security violation occurs, an SNMP
trap and Syslog message are generated.
In addition, you configure the device to take one of two actions when a security violation occurs: either drop
packets from the violating address (and allow packets from secure addresses), or disable the port altogether for a
specified amount of time.
To configure the device to drop packets from a violating address and allow packets from secure addresses:
ProCurveRS(config)# int e 7/11
ProCurveRS(config-if-e100-7/11)# port security
ProCurveRS(config-port-security-e100-7/11)# violation restrict
Syntax: violation restrict
To shut down the port for 5 minutes when a security violation occurs:
ProCurveRS(config)# int e 7/11
ProCurveRS(config-if-e100-7/11)# port security
ProCurveRS(config-port-security-e100-7/11)# violation shutdown 5
Syntax: violation shutdown <minutes>
You can specify from 0 – 1440 minutes. Specifying 0 shuts down the port permanently when a security violation
occurs.
NOTE: When using this feature with a 24-port 10/100 module (part number J4140A) only the shutdown option
is supported. The restrict option is not supported on the J4140A.
June 2005 5 - 3