Extreme Networks ExtremeWare Command Reference Manual page 236

Commands for Configuring Slots and Ports on a Switch
• Broadcast traffic
• EDP traffic
Traffic from the permanent MAC and any other non-blackholed MACs will still flow from the virtual
port.
If you configure a MAC address limit on VLANS that have ESRP enabled, you should add an
additional back-to-back link (that has no MAC address limit on these ports) between the ESRP-enabled
switches. Doing so prevents ESRP PDU from being dropped due to MAC address limit settings.
Port lockdown. The port lockdown feature allows you to prevent any additional learning on the
virtual port, keeping existing learned entries intact. This is equivalent to making the
dynamically-learned entries permanent static, and setting the learning limit to zero. All new source
MAC addresses are blackholed.
Locked entries do not get aged, but can be deleted like any other permanent FDB entries. The maximum
number of permanent lockdown entries is 1024. Any FDB entries above will be flushed and blackholed
during lockdown.
For ports that have lockdown in effect, the following traffic will still flow to the port:
• Packets destined for the permanent MAC and other non-blackholed MACs
• Broadcast traffic
• EDP traffic
Traffic from the permanent MAC will still flow from the virtual port.
Once the port is locked down, all the entries become permanent and will be saved across reboot. When
you remove the lockdown using the unlock-learning option, the learning-limit is reset to unlimited, and
all associated entries in the FDB are flushed.
To verify the MAC security configuration for the specified VLAN or ports, use the following
commands:
show vlan <vlan name> security
show ports <portlist> info detail
Example
The following command limits the number of MAC addresses that can be learned on ports 1, 2, 3, and 6
in a VLAN named accounting, to 128 addresses:
configure ports 1, 2, 3, 6 vlan accounting learning-limit 128
The following command locks ports 4 and 5 of VLAN accounting, converting any FDB entries to static
entries, and prevents any additional address learning on these ports:
configure ports 4,5 vlan accounting lock-learning
The following command removes the learning limit from the specified ports:
unlimited-learning
configure ports 1, 2, vlan accounting
The following command unlocks the FDB entries for the specified ports:
configure ports 4,5 vlan accounting unlock-learning
236 ExtremeWare Software 7.3.0 Command Reference Guide