R211x-HP Flexfabric 11900 Security Command Reference

127
Usage guidelines
You must disable global 802.1X and MAC authentication before you enable port security on a port.
Enabling or disabling port security resets the following security settings to the default:
• 802.1X access control mode is MAC-based, and the port authorization state is auto.
• Port security mode is noRestrictions.
When online users are present on a port, disabling port security also logs off the online users.
Examples
# Enable port security.
<Sysname> system-view
[Sysname] port-security enable
Related commands
• display port-security
• dot1x
• dot1x port-control
• dot1x port-method
• mac-authentication
port-security intrusion-mode
Use port-security intrusion-mode to configure the intrusion protection feature so the port takes the
predefined actions when intrusion protection detects illegal frames on the port.
Use undo port-security intrusion-mode to restore the default.
Syntax
port-security intrusion-mode { blockmac | disableport | disableport-temporarily }
undo port-security intrusion-mode
Default
Intrusion protection is disabled.
Views
Layer 2 Ethernet interface view
Predefined user roles
network-admin
mdc-admin
Parameters
blockmac: Adds the source MAC addresses of illegal frames to the blocked MAC address list and
discards frames with blocked source MAC addresses. This action implements illegal traffic filtering on the
port. A blocked MAC address is restored to normal after being blocked for 3 minutes, which is not user
configurable. To view the blocked MAC address list, use the display port-security mac-address block
command.
disableport: Disables the port permanently upon detecting an illegal frame received on the port.