Configuring Port Security Features; Configuring Ntk; Configuring Intrusion Protection - 3Com S7906E Configuration Manual

You cannot change the maximum number of secure MAC addresses allowed on a port that
operates in autoLearn mode.
OUI, defined by IEEE, is the first 24 bits of the MAC address and uniquely identifies a device
vendor.
You can configure multiple OUI values. However, a port in userLoginWithOUI mode allows only
one 802.1X user and one user whose MAC address contains a specified OUI.
After enabling port security, you can change the port security mode of a port only when the port is
operating in noRestrictions mode, the default mode. To change the port security mode of a port
operating in any other mode, use the undo port-security port-mode command to restore the
default port security mode at first.
You cannot change the port security mode of a port with users online.

Configuring Port Security Features

Configuring NTK

The need to know (NTK) feature checks the destination MAC addresses in outbound frames to allow
frames to be forwarded to only devices passing authentication. The NTK feature supports three modes:
ntkonly: Forwards only frames destined for authenticated MAC addresses.
ntk-withbroadcasts: Forwards only frames destined for authenticated MAC addresses or the
broadcast address.
ntk-withmulticasts: Forwards only frames destined for authenticated MAC addresses, multicast
addresses, or the broadcast address.
By default, NTK is disabled on a port and the port forwards all frames. With NTK configured, a port will
discard any unicast packet with an unknown MAC address no matter in which mode it operates.
Follow these steps to configure the NTK feature:
To do...
Enter system view
Enter interface view
Configure the NTK feature

Configuring Intrusion Protection

The intrusion protection enables a device to perform either of the following security policies when it
detects illegal frames:
Use the command...
system-view
interface interface-type
interface-number
port-security ntk-mode
{ ntk-withbroadcasts |
ntk-withmulticasts | ntkonly }
1-8
Remarks
—
—
Required
By default, NTK is disabled on
a port and all frames are
allowed to be sent.