Administrator Guide

Port and System Security 623
19
Port and System Security
Dell Networking N1500, N2000, N3000, and N4000 Series Switches
This chapter describes how to configure port-based and system security
features, which control access to the network through the switch ports, and
the denial of service (DoS) feature.
The topics covered in this chapter include:
• Port-based Security—Port MAC Locking
• Denial of Service
Port-based Security—Port MAC Locking
Port MAC locking is used to enable security on a per-port basis. When a port
is locked, only packets with allowable source MAC addresses can be
forwarded. All other packets are discarded. Port-MAC locking allows a
configurable limit to the number of source MAC addresses that can be
learned on a port.
The Port Security feature allows you to limit the number of source MAC
addresses that can be learned on a port. If a port reaches the configured limit,
any other addresses beyond that limit are not learned and the frames are
discarded. Frames with a source MAC address that has already been learned
will be forwarded.
The purpose of this feature, which is also known as port-MAC locking, is to
help secure the network by preventing unknown devices from forwarding
packets into the network. For example, to ensure that only a single device can
be active on a port, set the number of allowable dynamic addresses to one.
After the MAC address of the first device is learned, no other devices will be
allowed to forward frames into the network.
NOTE: Port-based security can also be accomplished by using Access Control
Lists (ACLs). For information about configuring ACLs, see "Access Control Lists "
on page 629.