DGS-3000 Series Layer 2 Managed Gigabit Ethernet Switch CLI Reference Guide
Chapter 65 Port Security Command List
config port_security system max_learning_addr [<max_lock_no 1-3328> | no_limit]
config port_security ports [<portlist> | all] [{admin_state [enable | disable] | max_learning_addr <max_lock_no
0-3328> | lock_address_mode [permanent | deleteontimeout | deleteonreset]} (1)| {vlan [<vlan_name 32> | vlanid <vidlist>] max_learning_addr [<max_lock_no 0-3328> | no_limit]}(1)]
config port_security vlan [<vlan_name 32> | vlanid <vidlist>] max_learning_addr [<max_lock_no 0-3328> | no_limit]
delete port_security_entry [vlan <vlan_name 32> | vlanid <vlanid 1-4094>] mac_address <macaddr>
clear port_security_entry {ports [<portlist> | all] {[vlan <vlan_name 32> | vlanid <vidlist>]}}
show port_security_entry {ports {<portlist>} {[vlan <vlan_name 32> | vlanid <vidlist>]}}
show port_security {ports {<portlist>} {[vlan <vlan_name 32> | vlanid <vidlist>]}} enable port_security trap_log disable port_security trap_log
65-1 config port_security system max_learning_addr
Description
This command is used to set the maximum number of port security entries that can be authorized system wide.
There are four levels of limitations on the learned entry number; for the entire system, for a port, for a VLAN, and for a specific VLAN on a port. If any limitation is exceeded, the new entry will be discarded.
The setting for system level maximum learned users must be greater than the total of maximum learned users allowed on all ports.
Format config port_security system max_learning_addr [<max_lock_no 1-3328> | no_limit]
Parameters
<max_lock_no 1-3328> - Enter the maximum number of port security entries that can be learned by the system.
If the setting is smaller than the number of current learned entries on all enabled ports, the command will be rejected. This value must be between 1 and 3328.
no_limit - No limitation on the number of port security entries that can be learned by the system. By default, the number is set to no_limit.
Restrictions
Only Administrators, Operators and Power-Users can issue this command.
Example
To configure the maximum number of port security entries on the Switch to be 256:
DGS-3000-26TC:admin#config port_security system max_learning_addr 256
Command: config port_security system max_learning_addr 256
Success.
DGS-3000-26TC:admin#
582
DGS-3000 Series Layer 2 Managed Gigabit Ethernet Switch CLI Reference Guide
65-2 config port_security ports
Description
This command is used to configure the admin state, the maximum number of addresses that can be learnt and the lock address mode.
There are four levels that limit the number of learned entries; the entire system, a port, a VLAN, and a specific
VLAN on a port. If any limitation is exceeded, the new entry will be discarded.
Format config port_security ports [<portlist> | all] [{admin_state [enable | disable] | max_learning_addr < max_lock_no 0-3328> | lock_address_mode [permanent | deleteontimeout | deleteonreset]} (1)| {vlan
[<vlan_name 32> | vlanid <vidlist>] max_learning_addr [<max_lock_no 0-3328> | no_limit]}(1)]
Parameters
<portlist> - Enter the list of port used for this configuration here.
all - Specify that all ports will be configured.
admin_state - (Optional) Specify the state of the port security function on the port.
enable - Specify to enable the port security function on the port.
disable - Specify to disable the port security function on the port. By default, the setting is disabled.
max_learning_addr - (Optional) Specify the maximum number of port security entries that can be learned on this port. If the value is set to 0, it means that no user can be authorized by the port security function on this port. If the setting is smaller than the number of current learned entries on the port, the command will be rejected. The default value is 32.
<max_lock_no 0-3328> - Enter the maximum number of port security entries that can be learned here. This value must be between 0 and 3328.
lock_address_mode - (Optional) Indicates the lock address mode. The default mode is deleteonreset.
permanent - The address will never be deleted unless the user removes it manually, the VLAN of the entry is removed, the port is removed from the VLAN, or port security is disabled on the port where the address resides.
deleteontimeout - This entry will be removed if the entry is idle for the specified aging time.
deleteonreset - This address will be removed if the Switch is reset or rebooted. Events that cause permanent entries to be deleted also apply to the deleteonreset entries.
vlan - (Optional) Specify the VLAN name used here.
<vlan_name 32> - Enter the VLAN name used here. This name can be up to 32 characters long.
vlanid - (Optional) Specify the VLAN ID used here.
<vidlist> - Enter the VLAN ID used here.
max_learning_addr - (Optional) Specify the maximum learning address value.
<max_lock_no 0-3328> - Enter the maximum learning address value here. This value must be between 0 and
3328.
no_limit - Specify that the maximum learning address value will be set to no limit.
Restrictions
Only Administrators, Operators and Power-Users can issue this command.
Example
To configure the port-based port security setting so that the maximum number of port security entries is restricted to 10, and the lock_address mode is set to permanent on port 6:
583
DGS-3000 Series Layer 2 Managed Gigabit Ethernet Switch CLI Reference Guide
DGS-3000-26TC:admin#config port_security ports 6 admin_state enable max_learning_addr 10 lock_address_mode permanent
Command: config port_security ports 6 admin_state enable max_learning_addr 10 lock_address_mode permanent
Success.
DGS-3000-26TC:admin#
65-3 config port_security vlan
Description
This command is used to set the maximum number of port security entries that can be learned on a specific VLAN.
There are four levels that limit the number of learned entries; the entire system, a port, a VLAN, and a specific
VLAN on a port. If any limitation is exceeded, the new entry will be discarded.
Format config port_security vlan [<vlan_name 32> | vlanid <vidlist>] max_learning_addr [<max_lock_no 0-3328> | no_limit]
Parameters
<vlan_name 32> - Enter the VLAN name here. This name can be up to 32 characters long.
vlanid - Specify a list of VLANs by VLAN ID.
<vidlist> - Enter the VLAN ID list here.
max_learning_addr - Specify the maximum number of port security entries that can be learned by this VLAN. If this parameter is set to 0, it means that no user can be authorized on this VLAN. If the setting is lower than the number of current learned entries on the VLAN, the command will be rejected. The default value is “no_limit”
<max_lock_no 0-3328> - Enter the maximum number of port security entries that can be learned here. This value must be between 0 and 3328.
no_limit - No limitation on the number of port security entries that can be learned by a specific VLAN.
Restrictions
Only Administrators, Operators and Power-Users can issue this command.
Example
To configure the maximum number of VLAN-based port security entries on VLAN 1 to be 64:
DGS-3000-26TC:admin#config port_security vlan vlanid 1 max_learning_addr 64
Command: config port_security vlan vlanid 1 max_learning_addr 64
Success.
DGS-3000-26TC:admin#
65-4 delete port_security_entry
Description
This command is used to delete a port security entry.
584
DGS-3000 Series Layer 2 Managed Gigabit Ethernet Switch CLI Reference Guide
Format delete port_security_entry [vlan <vlan_name 32> | vlanid <vlanid 1-4094>] mac_address <macaddr>
Parameters
vlan - Specify the VLAN by VLAN name.
<vlan_name 32> - Enter the VLAN name here. This name can be up to 32 characters long.
vlanid - Specify the VLAN by VLAN ID.
<vlanid 1-4094> - Enter the VLAN ID list here. This value must be between 1 and 4094.
mac_address - Specify the MAC address of the entry.
<macaddr> - Enter the MAC address used here.
Restrictions
Only Administrators, Operators and Power-Users can issue this command.
Example
To delete the port security entry with a MAC address of 00-00-00-00-00-01 on VLAN 1:
DGS-3000-26TC:admin#delete port_security_entry vlanid 1 mac_address 00-00-00-00-00-01
Command: delete port_security_entry vlanid 1 mac_address 00-00-00-00-00-01
Success.
DGS-3000-26TC:admin#
65-5 clear port_security_entry
Description
This command is used to clear the MAC entries learned by the port security function.
Format clear port_security_entry {ports [<portlist> | all] {[vlan <vlan_name 32> | vlanid <vidlist>]}}
Parameters
ports - (Optional) Specify the range of ports to be configured.
<portlist> - Enter the port security entries learned on the specified port.
all - All the port security entries learned by the system will be cleared.
vlan - (Optional) The port security entries learned on the specified VLANs will be cleared.
<vlan_name 32> - Enter the VLAN name here. This name can be up to 32 characters long.
vlanid - (Optional) Specify a list of VLANs by VLAN ID.
<vidlist> - Enter the VLAN ID list here.
Restrictions
Only Administrators, Operators and Power-Users can issue this command.
Example
To clear the port security entries on port 6:
585
DGS-3000 Series Layer 2 Managed Gigabit Ethernet Switch CLI Reference Guide
DGS-3000-26TC:admin#clear port_security_entry ports 6
Command: clear port_security_entry ports 6
Success.
DGS-3000-26TC:admin#
65-6 show port_security_entry
Description
This command is used to display the port security entries.
If more than one parameter is selected, only the entries matching all the selected parameters will be displayed.
If the user Specify ports and VLAN (either the VLAN name or VLAN ID list), only the entries matching all the parameters will be displayed.
Format show port_security_entry {ports {<portlist>} {[vlan <vlan_name 32> | vlanid <vidlist>]}}
Parameters
ports - (Optional) Specify the range of ports that will display the port security entries. While this parameter is null, to show the entries on all of the ports.
<portlist> - Enter the list of port used for this configuration here.
vlan - (Optional) Specify the name of the VLAN that the port security settings will be displayed for.
<vlan_name 32> - Enter the VLAN name here. This name can be up to 32 characters long.
vlanid - (Optional) Specify the ID of the VLAN that the port security entries will be displayed for.
<vidlist> - Enter the VLAN ID list here.
Restrictions
None.
Example
To show all the port security entries:
DGS-3000-26TC:admin#show port_security_entry
Command: show port_security_entry
MAC Address VID Port Lock Mode
----------------- ---- ----- ---------------
00-00-00-00-00-01 1 25 DeleteOnTimeout
Total Entries: 1
DGS-3000-26TC:admin#
65-7 show port_security
Description
This command is used to display the port security related information, including state, maximum learned addresses and lock address mode on a port and/or on a VLAN.
586
DGS-3000 Series Layer 2 Managed Gigabit Ethernet Switch CLI Reference Guide
If both ports and vlanid (or vlan_name) are specified, configurations matching any of these parameters will be displayed.
Format show port_security {ports {<portlist>} {[vlan <vlan_name 32> | vlanid <vidlist>]}}
Parameters
ports - (Optional) Specify the range of ports that will show their configuration. While this parameter is null, to show the entries on all of the ports.
<portlist> - Enter the list of port used for this configuration here.
vlan - (Optional) Specify the name of the VLAN that will show its configuration.
<vlan_name 32> - Enter the VLAN name here. This name can be up to 32 characters long.
vlanid - (Optional) Specify the ID of the VLAN that will show its configuration.
<vidlist> - Enter the VLAN ID list here.
Restrictions
None.
Example
To display the global configuration of port security:
DGS-3000-26TC:admin#show port_security
Command: show port_security
Port Security Trap/Log : Disabled
System Maximum Address : 256
VLAN Configuration (Only VLANs with limitation are displayed)
VID VLAN Name Max. Learning Addr.
---- -------------------------------- ------------------
1 default 64
DGS-3000-26TC:admin#
65-8 enable port_security trap_log
Description
This command is used to enable port security traps/logs. When this command is enabled, if there's a new MAC that violates the pre-defined port security configuration, a trap will be sent out with the MAC and port information and the relevant information will be logged.
Format enable port_security trap_log
Parameters
None.
Restrictions
Only Administrators, Operators and Power-Users can issue this command.
587
DGS-3000 Series Layer 2 Managed Gigabit Ethernet Switch CLI Reference Guide
Example
To enable a port security trap:
DGS-3000-26TC:admin#enable port_security trap_log
Command: enable port_security trap_log
Success.
DGS-3000-26TC:admin#
65-9 disable port_security trap_log
Description
This command is used to disable a port security trap/log. If the port security trap is disabled, no trap will be sent out for MAC violations, and no log will be recorded.
Format disable port_security trap_log
Parameters
None.
Restrictions
Only Administrators, Operators and Power-Users can issue this command.
Example
To prevent a port security trap from being sent from the switch:
DGS-3000-26TC:admin#disable port_security trap_log
Command: disable port_security trap_log
Success.
DGS-3000-26TC:admin#
588
