4

I am trying to set up HP procurve routers (25xx and 26xx) with port-security. Goal is to allow client devices and routers. But to disallow a switch, AP or a router in bridge mode. This should be accomplished by:

  • Limit MAC to 1 per switch port at any given time
  • Any MAC is allowed (as long as just one at the time)
  • It is OK to change device/MAC at any time

I have not tried yet. But is this accomplished doing this in the web interface security -> port-security (or similar cli command)

learn-mode: static
address-limit: 1
Violation Action: none

I am quite sure that it will limit the port to only 1 MAC. But will that be remembered "static" when the user change to another device?

Updated with solution, version 2

It need to be learn mode : limited-continuous. Action: none

It works just fine. It can be done from CLI for multiple ports at once. This line for port 1-23:

port-security 1-23 address-limit 1 learn-mode limited-continuous action none

About limited-continuous: http://h30499.www3.hp.com/t5/Switches-Hubs-Modems-Legacy-ITRC/port-security-learn-mode-limited-continuous/td-p/5179211#.Vd3CL5ej_1Q

If 'limited-continuous' is specified, the first 'address-limit' source MAC addresses heard on this port become the authorized addresses. When new authorized addresses are learned, they are stored in a table. When the table has reached its 'address-limit', any new source MAC addresses received on the port constitutes an intrusion. The authorized addresses in this mode will age out of the system, therefore the list of authorized addresses can be dynamic over time.

3

On page 9-10 of the manual it states that: This implies that the mac address limit will be reached, and will be remembered until flushed out manually.

A port in Static learn mode (learn-mode static) retains a learned MAC address even if you later reboot the switch or disableport security for that port:

From documentation:

You can authorize specific devices for the port, while still allowing the port to accept other, non-specified devices until the port reaches the configured address limit.

This leads me to believe that you can set the port limit at 1 and have it act the way you intend it to.

However, this sentence:

the port fills the remainder of the address allowance with MAC addresses it automatically learns

Leads me to believe the oposite. This is probably where the confusion is arising from. My advice would be to set it up on one port and try it, see what happens, and you'll have a definitive answer, this vagueness is rather annoying.

  • sorry, I should link to the documentation in the even anyone else wants to read through : ftp.hp.com/pub/networking/software/… – radiks32 Aug 13 '15 at 15:41
  • Thanks. I will get one of these into the office next week and try it out. – Tillebeck Aug 14 '15 at 8:11
  • Hi. It seems to work just fine. in CLI run "show config" and the port will list the MAC that is connected. Is a client removed, then "show config" will lst no MAC. So if no static MAC is set for the port it is updated dynamically. – Tillebeck Aug 20 '15 at 10:59
  • Nope... seems that the static does remember the last MAC and a new MAC is not allowed – Tillebeck Aug 26 '15 at 13:36
  • solved. Question updated on with the right info. – Tillebeck Aug 26 '15 at 20:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.