Permit specific MAC address per port

  • 0
  • 1
  • Question
  • Updated 1 year ago
  • Answered
I am trying to figure out how to enable port security on Extreme Summit 300-24 switches. Cisco provides this as a configurable feature. I don't believe Extreme has a comparable feature so I have been trying to use access lists to perform the same basic function. I have no problem creating the necessary access-msk and acl to permit a specific source mac address and apply it to a specific port but I believe I also have to create a deny all source mac acl entry to implicitly deny all other source mac addresses. It does not appear as though I can use wildcard for the implicit deny.
Does anyone have knowledge on how to accomplish this?

Thank you
Photo of Tom Gavin

Tom Gavin

  • 102 Points 100 badge 2x thumb

Posted 1 year ago

  • 0
  • 1
Photo of Erik Auerswald

Erik Auerswald, Embassador

  • 13,170 Points 10k badge 2x thumb
Hi Tom,

did you look into the Secure MAC feature?
You can configure a MAC address to be permitted only on a specified set of ports. Secure MAC addresses, if learned, are still aged out like other dynamically learned entries, and can also be cleared. To configure the authorized set of ports on which the MAC address should be permitted, use the following command:

create fdbentry secure-mac <mac_address> vlan <vlan name> ports <port-list>

To clear all the dynamic, non-permanent blackholed entries that were created as a result of secure MAC violations, use the following command:

clear fdb blackhole

To see the number of blackhole entries created as a result of secure MAC violations, use the following command:

show vlan <vlan_name> security

The output of the show fdb permanent command indicates secure MAC addresses.
Regarding the explicit deny, you could deny all IP traffic without checking the MAC address.

Thanks,
Erik
Photo of Andrew Imam

Andrew Imam, Alum

  • 1,026 Points 1k badge 2x thumb
Hi Tom,

In ExtremeWare you can enable lock learning on a port to lock the currently learned MAC address and not allow any other MACs to be learned on the specified port. The syntax for the command with its options is as follows:

configure ports <portlist> vlan <vlan name> [limit-learning <number> | lock-learning |
unlimited-learning | unlock-learning]

For example if you would like to locked the learned MAC for a device attached to port 1 that is part, the command will be:

configure ports 1 vlan <vlan name> lock-learning

Please let us know if you have any questions.
Thank you.


Best regards,
Andrew
Photo of Tom Gavin

Tom Gavin

  • 102 Points 100 badge 2x thumb
Andrew,

Tried it and it works great.
It does not get much easier than that!

Thank you
Tom
Photo of Andrew Imam

Andrew Imam, Alum

  • 1,026 Points 1k badge 2x thumb
Hi Tom,

Thanks for the update. I am glad that it worked for you.

Best regards,
Andrew