Mac Lockout - HP 3500yl Series Access Security Manual

Configuring and Monitoring Port Security

MAC Lockout

14-32
MAC Lockout
MAC Lockout involves configuring a MAC address on all ports and VLANs for
a switch so that any traffic to or from the "locked-out" MAC address will be
dropped. This means that all data packets addressed to or from the given
address are stopped by the switch. MAC Lockout is implemented on a per
switch assignment.
You can think of MAC Lockout as a simple blacklist. The MAC address is
locked out on the switch and on all VLANs. No data goes out or in from the
blacklisted MAC address to a switch using MAC Lockout.
To fully lock out a MAC address from the network it would be necessary to
use the MAC Lockout command on all switches.
To use MAC Lockout you must first know the MAC Address you wish to block.
Syntax: [no] lockout-mac < mac-address >
How It Works. Let's say a customer knows there are unauthorized wireless
clients who should not have access to the network. The network administrator
"locks out" the MAC addresses for the wireless clients by using the MAC
Lockout command (lockout-mac <mac-address>). When the wireless clients
then attempt to use the network, the switch recognizes the intruding MAC
addresses and prevents them from sending or receiving data on that network.
If a particular MAC address can be identified as unwanted on the switch then
that MAC Address can be disallowed on all ports on that switch with a single
command. You don't have to configure every single port—just perform the
command on the switch and it is effective for all ports.