Port Security Modes - H3C S5500-EI series Operation Manual

Operation Manual – Port Security
H3C S5500-EI Series Ethernet Switches
II. Intrusion protection
The intrusion protection feature checks the source MAC addresses in inbound frames
and takes a pre-defined action accordingly upon detecting illegal frames. The action
may be disabling the port temporarily, disabling the port permanently, or blocking
frames with the MAC address for three minutes (unmodifiable).
III. Trap
The trap feature enables the device to send trap messages upon detecting specified
frames that result from, for example, intrusion or user login/logout operations, helping
you monitor special activities.

1.1.3 Port Security Modes

Table 1-1
Table 1-1 Port security modes
Security mode
noRestrictions
autoLearn
secure
userLogin
details the port security modes.
Port security is disabled on the port and
access to the port is not restricted.
In this mode, a port can learn a specified
number of MAC addresses and save those
addresses as secure MAC addresses. It
permits only frames whose source MAC
addresses are secure MAC addresses or
static MAC addresses configured by using
the mac-address static command.
When the number of secure MAC addresses
reaches the upper limit, the port changes to
work in secure mode.
In this mode, a port is disabled from learning
MAC addresses and permits only frames
whose source MAC addresses are secure
MAC addresses or static MAC addresses
configured by using the mac-address static
command.
In this mode, a port performs 802.1x
authentication of users in portbased mode.
Chapter 1 Port Security Configuration
Description
1-2
Features
In this mode,
neither the NTK
nor the intrusion
protection
feature is
triggered.
In either mode,
the device will
trigger NTK and
intrusion
protection upon
detecting an
illegal frame.
In this mode,
neither NTK nor
intrusion
protection will be
triggered.