Example for Configuring Port Security
Networking Requirements
As shown in Figure 11-3, a company wants to prevent computers of non-employees from accessing the intranet of the company to protect information security. To achieve this goal, the company needs to enable port security on the interface connected to computers of employees and set the maximum number of MAC addresses learned by the interface to be the same as the number of trusted computers.
Configuration Roadmap
The configuration roadmap is as follows:
Configure a VLAN to implement Layer 2 forwarding.
Configure port security to prevent the learned MAC addresses from aging.
Procedure
- Create a VLAN and set the link type of the interface.
<HUAWEI> system-view [~HUAWEI] sysname Switch [*HUAWEI] commit [~Switch] vlan 10 [*Switch-vlan10] quit [*Switch] interface 10ge 1/0/1 [*Switch-10GE1/0/1] port link-type trunk [*Switch-10GE1/0/1] port trunk allow-pass vlan 10 [*Switch-10GE1/0/1] commit
- Configure port security.
# Enable port security.
[~Switch-10GE1/0/1] port-security enable
# Enable the sticky MAC function.
[*Switch-10GE1/0/1] port-security mac-address sticky
# Configure the security protection action.
[*Switch-10GE1/0/1] port-security protect-action protect
# Set the limit on the number of MAC addresses that can be learned on the interface.
[*Switch-10GE1/0/1] port-security maximum 4 [*Switch-10GE1/0/1] quit [*Switch] commit
To enable the port security function on other interfaces, repeat the preceding steps.
Assume that MAC addresses of four devices (three Servers and one access switch) connected to the Switch have been learned. The maximum number of MAC addresses to be learned is 4. - Verify the configuration.
If User1 is replaced by another device, the device cannot access the intranet of the company.
