Configuring the autoLearn mode

See Figure 70. Configure port GigabitEthernet 1/0/1 on the device, as follows:

• Accept up to 64 users on the port without authentication.

• Permit the port to learn and add MAC addresses as sticky MAC addresses, and set the secure MAC aging timer to 30 minutes.

• After the number of secure MAC addresses reaches 64, the port stops learning MAC addresses. If any frame with an unknown MAC address arrives, intrusion protection starts, and the port shuts down and stays silent for 30 seconds.

# Enable port security.

<Device> system-view
[Device] port-security enable

# Set the secure MAC aging timer to 30 minutes.

[Device] port-security timer autolearn aging 30

# Enable intrusion protection traps on port GigabitEthernet 1/0/1.

[Device] port-security trap intrusion
[Device] interface gigabitethernet 1/0/1

# Set port security's limit on the number of MAC addresses to 64 on the port.

[Device-GigabitEthernet1/0/1] port-security max-mac-count 64

# Set the port security mode to autoLearn.

[Device-GigabitEthernet1/0/1] port-security port-mode autolearn

# Configure the port to be silent for 30 seconds after the intrusion protection feature is triggered.

[Device-GigabitEthernet1/0/1] port-security intrusion-mode disableport-temporarily
[Device-GigabitEthernet1/0/1] quit
[Device] port-security timer disableport 30

# Display the port security configuration.

<Device> display port-security interface gigabitethernet 1/0/1
 Equipment port-security is enabled
 Intrusion trap is enabled
AutoLearn aging time is 30 minutes
 Disableport Timeout: 30s
 OUI value:

GigabitEthernet1/0/1 is link-up
   Port mode is autoLearn
   NeedToKnow mode is disabled
   Intrusion Protection mode is DisablePortTemporarily
   Max MAC address number is 64
   Stored MAC address number is 0
   Authorization is permitted
   Security MAC address learning mode is sticky 
   Security MAC address aging type is absolute

The output shows that the port security's limit on the number of secure MAC addresses on the port is 64, the port security mode is autoLearn, intrusion protection traps are enabled, and the intrusion protection action is disabling the port (DisablePortTemporarily) for 30 seconds.

# Repeatedly execute the display port-security command to track the number of MAC addresses learned by the port, or execute the display this command in Layer 2 Ethernet interface view to display the learned secure MAC addresses.

<Device> system-view
[Device] interface gigabitethernet 1/0/1
[Device-GigabitEthernet1/0/1] display this
#
interface GigabitEthernet1/0/1
 port-security max-mac-count 64
 port-security port-mode autolearn
 port-security mac-address security sticky 0002-0000-0015 vlan 1
 port-security mac-address security sticky 0002-0000-0014 vlan 1
 port-security mac-address security sticky 0002-0000-0013 vlan 1
 port-security mac-address security sticky 0002-0000-0012 vlan 1
 port-security mac-address security sticky 0002-0000-0011 vlan 1
#

# Execute the display port-security interface command after the number of MAC addresses learned by the port reaches 64. You can see that the port security mode has changed to secure. When any frame with a new MAC address arrives, intrusion protection is triggered and you see the following trap message:

#Jul 14 10:39:47:135 2009 Device PORTSEC/4/VIOLATION:Trap1.3.6.1.4.1.25506.2.26.1.
3.2<hhpeSecureViolation>
 An intrusion occurs!
 IfIndex: 9437185
 Port: 9437185
 MAC Addr: 00:02:00:00:00:32
 VLAN ID: 1
 IfAdminStatus: 1

# Execute the display interface command. You can see that the port security feature has disabled the port.

[Device-GigabitEthernet1/0/1] display interface gigabitethernet 1/0/1
 GigabitEthernet1/0/1 current state: DOWN (  Port Security Disabled  )
 IP Packet Frame Type: PKTFMT_ETHNT_2, Hardware Address: 000f-cb00-5558
 Description: GigabitEthernet1/0/1 Interface
 ......

The port should be re-enabled in 30 seconds.

[Device-GigabitEthernet1/0/1] display interface gigabitethernet 1/0/1
 GigabitEthernet1/0/1 current state: UP
 IP Packet Frame Type: PKTFMT_ETHNT_2, Hardware Address: 000f-cb00-5558
 Description: GigabitEthernet1/0/1 Interface
 ......

# Delete several secure MAC addresses. You can see that the port security mode of the port changes to autoLearn, and the port can learn MAC addresses again.