Shutdown The Interface; Restricting Interface Access - Dell PowerConnect B-RX Configuration Manual

32
Defining security violation actions
•
These actions can be configured on the global or interface level. The violation action on the global
level is not used if violation action is configured on an interface level.

Shutdown the interface

By default, the device shuts down the interface on the first violation. When the interface is
shutdown, it is disabled for a period of time, as specified by the configured age timer.
To enable this action, enter the following command.
BigIron RX(config)# int e 7/11
BigIron RX(config-if-e100-7/11)#port security
BigIron RX(config-port-security-e100-7/11)# violation shutdown
Syntax: [no] violation shutdown

Restricting interface access

You can configure the device to drop packets from an unsecure MAC address, while allowing
packets from secure MAC address to access the interface. The interface remains enabled.
To enable this action, enter the following commands.
BigIron RX(config)# int e 7/11
BigIron RX(config-if-e100-7/11)# port security
BigIron RX(config-port-security-e100-7/11)# violation restrict
Syntax: [no] violation restrict [<#-denied-packets-processed> | force]
The violation restrict command enables the violation restrict action.
Entering a value for #-denied-packets-processed specifies the number of packets from one
unsecure MAC address that can be processed in one second on the interface. Once this number is
reached, the interface is shutdown. Refer to
on page 936 for details.
Entering the force parameter forces the interface to shutdown once the
#-denied-packets-processed has been reached. If this parameter is not configured, then the
system will ask to confirm whether or not the interface is to be shutdown.
If violation restrict is the configured action when a security violation occurs, one of the following
options can be configured:
•
•
•
Restricting the number of packets per MAC address
You can indicate the number of packets in one second that can be processed for one particular
denied MAC address before the interface shuts down. If the number of packets received exceeds
this number, the interace shuts down.
To enable this option, enter a command such as the following.
936
Deny the packet from the unauthorized MAC address, but allow packets from secure MAC
addresses.
Restrict the number of packets received per MAC address
Restrict the number of MAC addresses denied on an interface
Log denied MAC addresses
"Restricting the number of packets per MAC address"
BigIron RX Series Configuration Guide
53-1001986-01