topic RE: Permit specific MAC address per port in Security

Permit specific MAC address per port

Tom_Gavin — Wed, 07 Jun 2017 02:31:00 GMT

I am trying to figure out how to enable port security on Extreme Summit 300-24 switches. Cisco provides this as a configurable feature. I don't believe Extreme has a comparable feature so I have been trying to use access lists to perform the same basic function. I have no problem creating the necessary access-msk and acl to permit a specific source mac address and apply it to a specific port but I believe I also have to create a deny all source mac acl entry to implicitly deny all other source mac addresses. It does not appear as though I can use wildcard for the implicit deny.
Does anyone have knowledge on how to accomplish this?

Thank you

RE: Permit specific MAC address per port

Erik_Auerswald — Thu, 08 Jun 2017 14:33:00 GMT

Hi Tom,

did you look into the Secure MAC feature?

You can configure a MAC address to be permitted only on a specified set of ports. Secure MAC addresses, if learned, are still aged out like other dynamically learned entries, and can also be cleared. To configure the authorized set of ports on which the MAC address should be permitted, use the following command:

create fdbentry secure-mac vlan ports

To clear all the dynamic, non-permanent blackholed entries that were created as a result of secure MAC violations, use the following command:

clear fdb blackhole

To see the number of blackhole entries created as a result of secure MAC violations, use the following command:

show vlan security

The output of the show fdb permanent command indicates secure MAC addresses.

Regarding the explicit deny, you could deny all IP traffic without checking the MAC address.

Thanks,
Erik

RE: Permit specific MAC address per port

Andrew_Imam — Thu, 08 Jun 2017 15:03:00 GMT

Hi Tom,

In ExtremeWare you can enable lock learning on a port to lock the currently learned MAC address and not allow any other MACs to be learned on the specified port. The syntax for the command with its options is as follows:

configure ports vlan [limit-learning | lock-learning |
unlimited-learning | unlock-learning]

For example if you would like to locked the learned MAC for a device attached to port 1 that is part, the command will be:

configure ports 1 vlan lock-learning

Please let us know if you have any questions.
Thank you.

Best regards,
Andrew

RE: Permit specific MAC address per port

Tom_Gavin — Thu, 08 Jun 2017 15:03:00 GMT

Andrew,

Tried it and it works great.
It does not get much easier than that!

Thank you
Tom

RE: Permit specific MAC address per port

Andrew_Imam — Thu, 08 Jun 2017 15:03:00 GMT

Hi Tom,

Thanks for the update. I am glad that it worked for you.

Best regards,
Andrew