Permit specific MAC address per port

[Tom_Gavin]

I am trying to figure out how to enable port security on Extreme Summit 300-24 switches. Cisco provides this as a configurable feature. I don't believe Extreme has a comparable feature so I have been trying to use access lists to perform the same basic function. I have no problem creating the necessary access-msk and acl to permit a specific source mac address and apply it to a specific port but I believe I also have to create a deny all source mac acl entry to implicitly deny all other source mac addresses. It does not appear as though I can use wildcard for the implicit deny.
Does anyone have knowledge on how to accomplish this?

Thank you

[Andrew_Imam]

Hi Tom,

In ExtremeWare you can enable lock learning on a port to lock the currently learned MAC address and not allow any other MACs to be learned on the specified port. The syntax for the command with its options is as follows:

configure ports vlan [limit-learning | lock-learning |
unlimited-learning | unlock-learning]

For example if you would like to locked the learned MAC for a device attached to port 1 that is part, the command will be:

configure ports 1 vlan lock-learning

Please let us know if you have any questions.
Thank you.

Best regards,
Andrew

[Andrew_Imam]

Hi Tom,

Thanks for the update. I am glad that it worked for you.

Best regards,
Andrew

[Tom_Gavin]

Andrew,

Tried it and it works great.
It does not get much easier than that!

Thank you
Tom

[Erik_Auerswald]

Hi Tom,

did you look into the Secure MAC feature?

You can configure a MAC address to be permitted only on a specified set of ports. Secure MAC addresses, if learned, are still aged out like other dynamically learned entries, and can also be cleared. To configure the authorized set of ports on which the MAC address should be permitted, use the following command:

create fdbentry secure-mac vlan ports

To clear all the dynamic, non-permanent blackholed entries that were created as a result of secure MAC violations, use the following command:

clear fdb blackhole

To see the number of blackhole entries created as a result of secure MAC violations, use the following command:

show vlan security

The output of the show fdb permanent command indicates secure MAC addresses.

Regarding the explicit deny, you could deny all IP traffic without checking the MAC address.

Thanks,
Erik