Brocade Multi-Service IronWare Security Configuration Guid Manual de usuario descargar pdf (Pagina 304)

286 Multi-Service IronWare Security Configuration Guide

53-1003035-02

Configuring the MAC port security feature

The secure MAC addresses are not flushed when an interface is disabled and brought up again.

The secure addresses can be kept secure permanently (the default), or can be configured to age

out, at which time they are no longer secure. You can configure the device to automatically save the

list of secure MAC addresses to the startup-config file at specified intervals, allowing addresses to

be kept secure across system restarts.

The port security feature applies only to Ethernet interfaces.

Configuration Considerations

When using the MAC port security feature, the following should be considered.

• If there is no port security configuration at the interface level, global level port security

configuration is inherited.

• If a port security attribute is configured at the interface level, interface level configuration for

that attribute takes precedence over global level configuration for the same attribute.The rest

of the port security attributes that are not configured at the interface level will be inherited

from the global level configuration.

Local and global resources

The port security feature uses a concept of local and global “resources” to determine how many

MAC addresses can be secured on each interface. In this context, a “resource” is the ability to store

one secure MAC address entry. Each interface is allocated 64 local resources. When the port

security feature is enabled, the interface can store up to 64 secure MAC addresses using local

resources.

Besides the maximum of 64 local resources available to an interface, there are 4096 global

resources available. When an interface has secured enough MAC addresses to reach its limit for

local resources, it can secure additional MAC addresses by using global resources. Global

resources are shared among all the interfaces on a first-come, first-served basis.

The maximum number of MAC addresses any single interface can secure is 64 (the maximum

number of local resources available to the interface), plus the number of global resources not

allocated to other interfaces.

Configuring the MAC port security feature

To configure the MAC port security feature, you perform the following tasks:

• Enable the MAC port security feature

• Set the maximum number of secure MAC addresses for an interface

• Set the port security age timer

• Specify secure MAC addresses

• Configure the device to automatically save secure MAC addresses to the startup-config file

• Specify the action taken when a security violation occurs

• Deny specific MAC addresses

• Port Security MAC Violation Limits

1 2 ... 299 300 301 302 303 304 305 306 307 308 309 ... 369 370

Sin comentarios

Brocade Multi-Service IronWare Security Configuration Guid Manual de usuario Pagina 304