Port security modes

Port security supports the following categories of security modes:

Upon receiving a frame, the port in a security mode searches the MAC address table for the source MAC address. If a match is found, the port forwards the frame. If no match is found, the port learns the MAC address or performs authentication, depending on the security mode. If the frame is illegal, the port takes the pre-defined NTK, intrusion protection, or trapping action.

The maximum number of users a port supports equals the maximum number of MAC addresses that port security allows or the maximum number of concurrent users the authentication mode in use allows, whichever is smaller. For example, if 802.1X allows more concurrent users than port security's limit on the number of MAC addresses on the port in userLoginSecureExt mode, port security's limit takes effect.

Table 13 describes the port security modes and the security features.

Table 13: Port security modes

Purpose

Security mode

Features that can be triggered

Turning off the port security feature

noRestrictions (the default mode)

In this mode, port security is disabled on the port and access to the port is not restricted.

N/A

Controlling MAC address learning

autoLearn

NTK/intrusion protection

secure

Performing 802.1X authentication

userLogin

N/A

userLoginSecure

NTK/intrusion protection

userLoginSecureExt

userLoginWithOUI

Performing MAC authentication

macAddressWithRadius

NTK/intrusion protection

Performing a combination of MAC authentication and 802.1X authentication

Or

macAddressOrUserLoginSecure

NTK/intrusion protection

macAddressOrUserLoginSecureExt

Else

macAddressElseUserLoginSecure

macAddressElseUserLoginSecureExt


[TIP: ]

TIP:

  • userLogin specifies 802.1X authentication and port-based access control.

  • macAddress specifies MAC authentication.

  • Else specifies that the authentication method before Else is applied first. If the authentication fails, whether to turn to the authentication method following Else depends on the protocol type of the authentication request.

  • Typically, in a security mode with Or, the authentication method to be used depends on the protocol type of the authentication request.

  • userLogin with Secure specifies 802.1X authentication and MAC-based access control.

  • Ext indicates allowing multiple 802.1X users to be authenticated and serviced at the same time. A security mode without Ext allows only one user to pass 802.1X authentication.


Controlling MAC address learning

Performing 802.1X authentication

Performing MAC authentication

macAddressWithRadius: A port in this mode performs MAC authentication and services multiple users.

Performing a combination of MAC authentication and 802.1X authentication


[NOTE: ]

NOTE:

An OUI, as defined by the IEEE, is the first 24 bits of the MAC address, which uniquely identifies a device vendor.