BigIron RX Series Configuration Guide 93153-1001986-01Chapter32Using the MAC Port Security Featureand Transparent Port FloodingThis chapter discusses the MAC Port Security and transparent port flooding features.MAC Port SecurityThe MAC Port Security feature restricts unauthorized access to an interface by limiting andidentifying MAC addresses that are allowed to access an Ethernet interface on a device. You canconfigure the BigIron RX with a limited number of “secure” MAC addresses on an interface. Theinterface will forward only packets with source MAC addresses that match these secure addresses.The secure MAC addresses can be specified manually (static), or the device can learn themautomatically (dynamic).An interface can store up to the maximum number of secure MAC addresses. If the maximumnumber of secure MAC addresses are learned and the interface receives a packet with a sourceMAC address that is different from any of the secure learned MAC addresses, the address isconsidered a security violation.NOTEThe MAC Port Security feature applies only to Ethernet interfaces. It is not available on loopback,virtual routing (ve) or other interface types.Violation actionsWhen a security violation occurs, a Syslog entry is generated. In addition, the device takes one ofthe following actions:• Shuts down the interface, either permanently or for a specified amount of time. This is thedefault.• Drops packets from the unauthorized MAC address, but allows packets from the secure MACaddresses. The interface remains enabled.• Denies the packet from the unauthorized MAC address, but allows packets from secure MACaddresses. The interface remains enabled.The secure MAC addresses are not flushed when an interface is disabled and brought up again.The secure addresses can be kept secure permanently (the default), or can be configured to ageout, at which time they are no longer secure. You can configure the device to automatically save thelist of secure MAC addresses to the startup-config file at specified intervals, allowing addresses tobe kept secure across system restarts.
