No relevant resource is found in the selected language.

This site uses cookies. By continuing to browse the site you are agreeing to our use of cookies. Read our privacy policy>Search

Reminder

To have a better experience, please upgrade your IE browser.

upgrade

S2700, S3700, S5700, S6700, S7700, and S9700 Series Switches Typical Configuration Examples

This document provides examples for configuring features in typical usage scenarios.
Rate and give feedback:
Huawei uses machine translation combined with human proofreading to translate this document to different languages in order to help you better understand the content of this document. Note: Even the most advanced machine translation cannot match the quality of professional translators. Huawei shall not bear any responsibility for translation accuracy and it is recommended that you refer to the English document (a link for which has been provided).
Example for Configuring Port Security

Example for Configuring Port Security

Port Security Overview

Port security changes the dynamic MAC addresses learned on an interface into secure MAC addresses (including dynamic and static secure MAC addresses, and sticky MAC addresses). This function prevents unauthorized users from communicating with the switch using this interface. Generally, port security is configured on access devices to bind users to interfaces and control access users on interfaces.

Compared with the static MAC address entry and user-bind used to bind users statically, port security dynamically binds users to interfaces.

Compared with DHCP snooping that also dynamically binds users to interface, port security is easier to configure. In addition, port security can limit the number of access users.

Configuration Notes

  • After MAC address limiting is configured on an interface, port security cannot be configured on the interface.
  • This example applies to all versions of all S series switches.

Networking Requirements

As shown in Figure 15-16, PC1, PC2, and PC3 connect to the company network through the switch. To improve user access security, port security is enabled on the interface of the switch so that external users cannot use their PCs to access the company network.

Figure 15-16  Networking for configuring port security

Configuration Roadmap

The configuration roadmap is as follows:

  1. Create a VLAN to implement Layer 2 forwarding.

  2. Configure port security and enable the sticky MAC function so that MAC address entries are not lost after the device configuration is saved and the device restarts.

Procedure

  1. Create a VLAN on the switch and add interfaces to the VLAN. The configurations of GE1/0/2 and GE1/0/3 are similar to the configuration of 1/0/1, and are not mentioned here.

    <HUAWEI> system-view
    [HUAWEI] sysname Switch
    [Switch] vlan 10   //Create VLAN 10.
    [Switch-vlan10] quit
    [Switch] interface gigabitethernet 1/0/1
    [Switch-GigabitEthernet1/0/1] port link-type access   //The link type of the interface connected to the PC must be access. The default link type of an interface is not access, so you need to manually configure the link type of the interface.
    [Switch-GigabitEthernet1/0/1] port default vlan 10
    [Switch-GigabitEthernet1/0/1] quit
    

  2. Configure port security on GE1/0/1. The configurations of GE1/0/2 and GE1/0/3 are similar to the configuration of GE1/0/1, and are not mentioned here.

    [Switch] interface gigabitethernet 1/0/1
    [Switch-GigabitEthernet1/0/1] port-security enable   //Enable port security.
    [Switch-GigabitEthernet1/0/1] port-security mac-address sticky   //The sticky MAC function can be enabled only after port security is enabled.
    [Switch-GigabitEthernet1/0/1] port-security max-mac-num 1   //After port security is enabled, an interface can learn only one secure MAC address entry by default. If one user needs to be limited, ignore this configuration.
    NOTE:
    • An interface can learn only one secure MAC address entry by default. If multiple PCs connect to the company network using one interface, run the port-security max-mac-num command to change the maximum number of secure MAC addresses.
    • If a PC connects to the switch using an IP phone, set the maximum number of secure MAC addresses to 3 because the IP phone occupies two MAC address entries and the PC occupies one MAC address entry. The VLAN IDs in two MAC address entries used by the IP phone are different. The two VLANs are used to transmit voice and data packets respectively.

  3. Verify the configuration.

    If PC1, PC2, and PC3 are replaced by other PCs, the PCs cannot access the company network.

Configuration Files

Configuration file of the switch

#
sysname Switch
#
vlan batch 10
#
interface GigabitEthernet1/0/1
 port link-type access                                                          
 port default vlan 10 
 port-security enable
 port-security mac-address sticky
#
interface GigabitEthernet1/0/2
 port link-type access                                                          
 port default vlan 10 
 port-security enable
 port-security mac-address sticky
#
interface GigabitEthernet1/0/3
 port link-type access                                                          
 port default vlan 10 
 port-security enable
 port-security mac-address sticky
#
return
Download
Updated: 2019-04-20

Document ID: EDOC1000069520

Views: 691774

Downloads: 30134

Average rating:
This Document Applies to these Products
Related Documents
Related Version
Share
Previous Next