174
Port security modes
Port security supports the following categories of security modes:
•
MAC learning control
—Includes two modes,
autoLearn
and
secure
. MAC address learning is
permitted on a port in
autoLearn
mode and disabled in
secure
mode.
•
Authentication
—Security modes of this category use MAC authentication, 802.1X authentication,
or their combinations to implement authentication.
Upon receiving a frame, the port in a security mode searches the MAC address table for the source
MAC address. If a match is found, the port forwards the frame. If no match is found, the port learns the
MAC address or performs authentication, depending on the security mode. If an illegal frame or event is
detected, the port takes the predefined NTK, intrusion protection, or trapping action.
describes the port security modes and the security features.
Table 9
Port security modes
Purpose Security
mode
Features that can
be triggered
Turn off the port security feature
noRestrictions (the default mode)
In this mode, port security is disabled on the port,
and access to the port is not restricted.
—
autoLearn
NTK/intrusion
protection
secure
userLogin —
userLoginSecure
NTK/intrusion
protection
userLoginSecureExt
userLoginWithOUI
macAddressWithRadius
NTK/intrusion
protection
Perform a combination of MAC
authentication and 802.1X
Or
macAddressOrUserLoginSecure
NTK/intrusion
protection
macAddressOrUserLoginSecureExt
Else
macAddressElseUserLoginSecure
macAddressElseUserLoginSecureExt
TIP:
•
userLogin
specifies 802.1X authentication and port-based access control.
•
macAddress
specifies MAC authentication.
•
Else
specifies that the authentication method before
Else
is applied first. If the authentication fails,
whether to turn to the authentication method following
Else
depends on the protocol type of the
authentication request.
•
In a security mode with
Or
, which authentication method to be used depends on the protocol type of the
authentication request.
•
userLogin
with
Secure
specifies 802.1X authentication and MAC-based access control.
•
Ext
indicates allowing multiple 802.1X users to be authenticated and serviced at the same time. A
security mode without
Ext
allows only one user to pass 802.1X authentication.
