User manual FOUNDRY NETWORKS EDGELRON

[. . . ] Foundry EdgeIron User Guide 2100 Gold Street 4980 Great America Parkway Santa Clara, CA 95054 Tel 408. 207. 1700 www. foundrynetworks. com March 2006 Copyright © 2006 Foundry Networks, Inc. No part of this work may be reproduced in any form or by any means ­ graphic, electronic or mechanical, including photocopying, recording, taping or storage in an information retrieval system ­ without prior written permission of the copyright owner. The trademarks, logos and service marks ("Marks") displayed herein are the property of Foundry or other third parties. You are not permitted to use these Marks without the prior written consent of Foundry or such appropriate third party. [. . . ] Example The following example clears statistics on port 5. Console#clear counters ethernet 1/5 Console# Configuring Port Security Note: This feature is available on devices running release 2. 2. 5. 16 and later. port security Use this command to enable and configure port security on a port. Use the no form to disable port security, delete secure MAC addresses, or set other parameters to their default values. Syntax port security [mac-address mac-address | vlan vlan-id | max-mac-count value {action {shutdown | trap | trap-and-shutdown | shutdown-interval minutes | restrict}}] no port security [mac-address mac-address] · mac-address - Specifies a secure 48-bit MAC address for the interface. · max-mac-count - Sets the maximum number of secure MAC addresses for the interface. (Range: 1-20; Default: 1) · action - Indicates the security action to be taken when a port security violation is detected. - trap-and-shutdown - Issue an SNMP trap message and disable the port. · shutdown-interval - Sets the shutdown interval if there is a port security violation. (Range: 1-1440 minutes; Default: Permanently disable the port) - restrict - Restricts illegal MAC addresses from gaining access to the network. Default Setting Status: Disabled Action: None Maximum Address: 0 17-20 © 2006 Foundry Networks, Inc. March 2006 Interface Commands Command Mode Interface Configuration (Ethernet) Command Usage · If you enable port security, the switch stops learning new MAC addresses on the specified port when it has reached a configured maximum number. Only incoming traffic with source addresses already stored in the dynamic or static address table will be accepted. · First use the port security max-mac-count command to set the number of addresses, and then use the port security command to enable security on the port. · Use the no port security max-mac-count command to disable port security and reset the maximum number of addresses to the default. · You can also manually add secure addresses with the mac-address-table static command. · A secure port has the following restrictions: - Cannot be connected to a network interconnection device. - It can be configured as an LACP trunk port, but the switch does not allow the LACP trunk to be enabled. · A port that is already configured as an LACP or static trunk port cannot be enabled as a secure port. · If a port is disabled due to a security violation, it must be manually re-enabled by using the no shutdown command. Example This example sets the port security action for port 5. Console(config)#interface ethernet 1/5 Console(config-if)#port security action trap-and-shutdown Console(config-if)#port security Console(config-if)# Related Commands shutdown (17-19) mac-address-table static (20-2) port security aging Use this command to age learned secure address entries for all ports. Syntax [no] port security aging Default Setting Status: Disabled Command Mode Global Configuration March 2006 © 2006 Foundry Networks, Inc. 17-21 Foundry EdgeIron User Guide Command Usage · Use this command to enable the aging feature. · To change the aging time for other addresses use the mac-address-table aging-time command. Example The following example enables port security aging. Console#configure Console(config)#port security aging 15 Console(config)# port security autosave Use this command to automatically save learned secure MAC addresses to the startup configuration file. Syntax [no] port security autosave [update-interval] · update-interval - Allows the user to set a time for the switch to periodically save the port security configuration to the startup configuration. [. . . ] It eliminates the polling required in standard SNMP, and can set alarms on a variety of traffic conditions, including specific error types. Routing Information Protocol (RIP) The RIP protocol seeks to find the shortest route to another device by minimizing the distance-vector, or hop count, which serves as a rough estimate of transmission cost. It adds useful capabilities for subnet routing, authentication, and multicast transmissions. Secure Shell (SSH) A secure replacement for remote access functions, including Telnet. [. . . ]