Security

  • 1.  Permit specific MAC address per port

    Posted 06-06-2017 19:31
    I am trying to figure out how to enable port security on Extreme Summit 300-24 switches. Cisco provides this as a configurable feature. I don't believe Extreme has a comparable feature so I have been trying to use access lists to perform the same basic function. I have no problem creating the necessary access-msk and acl to permit a specific source mac address and apply it to a specific port but I believe I also have to create a deny all source mac acl entry to implicitly deny all other source mac addresses. It does not appear as though I can use wildcard for the implicit deny.
    Does anyone have knowledge on how to accomplish this?

    Thank you


  • 2.  RE: Permit specific MAC address per port

    Posted 06-08-2017 07:33
    Hi Tom,

    did you look into the Secure MAC feature?
    You can configure a MAC address to be permitted only on a specified set of ports. Secure MAC addresses, if learned, are still aged out like other dynamically learned entries, and can also be cleared. To configure the authorized set of ports on which the MAC address should be permitted, use the following command:

    create fdbentry secure-mac
    Regarding the explicit deny, you could deny all IP traffic without checking the MAC address.

    Thanks,
    Erik


  • 3.  RE: Permit specific MAC address per port

    Posted 06-08-2017 08:03
    Hi Tom,

    In ExtremeWare you can enable lock learning on a port to lock the currently learned MAC address and not allow any other MACs to be learned on the specified port. The syntax for the command with its options is as follows:

    configure ports vlan


  • 4.  RE: Permit specific MAC address per port

    Posted 06-08-2017 08:03

    Andrew,

    Tried it and it works great.
    It does not get much easier than that!

    Thank you
    Tom


  • 5.  RE: Permit specific MAC address per port

    Posted 06-08-2017 08:03
    Hi Tom,

    Thanks for the update. I am glad that it worked for you.

    Best regards,
    Andrew