Allied Telesis AT-S62 - Manual (Page 634)

Chapter 28: MAC Address-based Port Security
634 Section VI: Port Security
MAC Address-based Port Security Overview
This feature can enhance the security of your network. You can use it to
control which end nodes can forward frames through the switch, and so
prevent unauthorized individuals from accessing your network or particular
parts of the network.
This type of network security uses a frame’s source MAC address to
determine whether the switch should forward a frame or discard it. The
source address is the MAC address of the end node that sent the frame.
There are four levels of port security:
ˆ Automatic
ˆ Limited
ˆ Secured
ˆ Locked
You set port security on a per port basis. Only one security level can be
active on a port at a time.
Automatic
The Automatic security mode disables MAC address port security on a
port. This is the default security level for a port.
Limited
With this security level you specify the maximum number of dynamic MAC
addresses a port can learn. Packets are forwarded based only on the
learned addresses. Packets with an unlearned address are discarded.
When the Limited security mode is initially activated on a port, all dynamic
MAC addresses learned by the port are deleted from the MAC address
table and the port begins to learn new addresses, up to the maximum
allowed. After the port has learned its maximum number, it does not learn
any new addresses and forwards a packet only if its source address had
already been learned.
A dynamic MAC address learned on a port operating in the Limited
security mode never times out from the MAC address table, even when
the corresponding end node is inactive. However, the addresses are not
retained when a switch is reset or power cycled. Instead, a port repeats
the MAC address learning process, up to the specified maximum.
Static MAC addresses are retained by the port and are not included in the
count of maximum dynamic addresses. You can continue to add static
MAC addresses to a port operating with this security level, even after the
port has already learned its maximum number of dynamic MAC
addresses. A switch port can have up to 255 dynamic and static MAC
addresses.