I was trying to experiment with the EXOS version of what we do on our Cisco switches which is mac-address based security tied to a port.
Sometimes we will use the following cisco commands on a port for example:
switchport port-security maximum 2
switchport port-security mac-address sticky
switchport port-security mac-address sticky 484d.7e00.0000 vlan access
switchport port-security mac-address sticky 0004.f200.0001 vlan voice
Really we just type in the first two lines, and the switch automatically fills in the lines with the mac addresses as they are learned. If you plug a different device in, the port shuts down. If you plug one of those devices into a different port on the switch, the port shuts down. If moving devices or swapping devices we just issue a no in front of the command with the mac address we want to remove, after the cable is unplugged.
So I have a laptop here with two USB nics and I just want to try the EXOS equivalent of this, but limit it to learning one mac address, so I can verify with my second nic that the port will shut down.
I first found this on gtac kb:
configure port 2 vlan Default limit-learning 1 action stop-learning[/code]
However I get a network connection with either USB nic and sucessful pings. So it doesn't appear to be stoping anything.
Then I found this one on gtac kb:
configure mac-locking ports 2 first-arrival limit-learning 1[/code]
However the first command above is still on port 2 on this test switch, see below:
* X450G2-24p-G4.102 # sh configuration | grep learning
configure port 2 vlan Default limit-learning 1 action stop-learning
configure mac-locking ports 2 first-arrival limit-learning 1
[/code]How can I make the first line "go away"? I tried unconfigure port 2 vlan Default limit-learning 1 action stop-learning and it was invalid.
Also can you steer me in the right direction how to accomplish (and maintain) the equivalant Cisco feature on EXOS?
I eventually want to get this working in Netsight under Control with our nac VM. Were a very new install and though I have stuff in there on this test switch, it doesn't block traffic. I'm envisioning an easy to use and maintain place for the entire IT department of 6 to go in and add or remove mac addresses to a list. Basically if your mac address is in that list, you are on the network. If not, the port goes dead.