Zyxel OLT2412 [141/326] Port security
Макгруп McGrp.ru
Задайте вопрос
Зарегистрироваться

Zyxel OLT2412 [141/326] Port security

Zyxel OLT2412 [141/326] Port security
OLT2412 User’s Guide 141
CHAPTER 19
Port Security
This chapter shows you how to set up port security.
19.1 About Port Security
Port security allows only packets with dynamically learned MAC addresses and/or configured static
MAC addresses to pass through a port on the OLT. The OLT can learn up to 32K MAC addresses in
total with no limit on individual ports other than the sum cannot exceed 32K.
For maximum port security, enable this feature, disable MAC address learning and configure static
MAC address(es) for a port. It is not recommended you disable port security together with MAC
address learning as this will result in many broadcasts. By default, MAC address learning is still
enabled even though port security is not activated.
With port-security enabled on the OLT, each subscriber port counts the number of newly learnt MAC
addresses. Configure the number of MAC addresses a specific port can learn and the OLT drops
Source Lookup Failure (SLF) packets on the port that exceed the limit.
Anti-MAC spoofing lets you set whether or not to allow a subscriber device to move between OLT
subscriber ports. This means the OLT has learned a subscriber device’s source MAC address at one
port but receives packets containing the same source MAC address through another subscriber port
before the learned MAC address times out from the MAC address table. Disable anti-MAC spoofing
to have the OLT allow the port move and learn the source MAC address on the new port. Enable
anti-MAC spoofing to have the OLT drop the packets and not learn the source MAC address on the
new port. Anti-MAC spoofing applies to the subscriber ports, not the uplink ports.
19.2 Port Security Setup Commands
Activate port-security on the OLT and on PON port GE-5-1 (slot 5, PON port 1). Use “ge” for a PON
or Gigabit Ethernet port. Use “xe” for an uplink port. Then limit the number of (dynamic) MAC
addresses subscriber port GE-5-1 can learn to 100.
Activate learning mode on PON port GE-5-1 (slot 5, PON port 1). Use “ge” for a PON or Gigabit
Ethernet port. Use “xe” for an uplink port.
OLT2412#config
OLT2412(config)# port-security
OLT2412(config)# port-security ge-5-1
OLT2412(config)# port-security ge-5-1 address-limit 256
OLT2412#config
OLT2412(config)# no port-security ge-5-1 learn inactive

Содержание

Похожие устройства

Скачать