pfsense port-security limit mac to 1 (any mac allowed)

Question

I am trying to set up HP procurve routers (25xx and 26xx) with port-security. Goal is to allow client devices and routers. But to disallow a switch, AP or a router in bridge mode. This should be accomplished by:

• Limit MAC to 1 per switch port at any given time
• Any MAC is allowed (as long as just one at the time)
• It is OK to change device/MAC at any time

I have not tried yet. But is this accomplished doing this in the web interface security -> port-security (or similar cli command)

learn-mode: static
address-limit: 1
Violation Action: none

I am quite sure that it will limit the port to only 1 MAC. But will that be remembered "static" when the user change to another device?

Updated with solution, version 2

It need to be learn mode : limited-continuous. Action: none

It works just fine. It can be done from CLI for multiple ports at once. This line for port 1-23:

port-security 1-23 address-limit 1 learn-mode limited-continuous action none

About limited-continuous: http://h30499.www3.hp.com/t5/Switches-Hubs-Modems-Legacy-ITRC/port-security-learn-mode-limited-continuous/td-p/5179211#.Vd3CL5ej_1Q

If 'limited-continuous' is specified, the first 'address-limit' source MAC addresses heard on this port become the authorized addresses. When new authorized addresses are learned, they are stored in a table. When the table has reached its 'address-limit', any new source MAC addresses received on the port constitutes an intrusion. The authorized addresses in this mode will age out of the system, therefore the list of authorized addresses can be dynamic over time.

Answer 1

On page 9-10 of the manual it states that: This implies that the mac address limit will be reached, and will be remembered until flushed out manually.

A port in Static learn mode (learn-mode static) retains a learned MAC address even if you later reboot the switch or disableport security for that port:

From documentation:

You can authorize specific devices for the port, while still allowing the port to accept other, non-specified devices until the port reaches the configured address limit.

This leads me to believe that you can set the port limit at 1 and have it act the way you intend it to.

However, this sentence:

the port fills the remainder of the address allowance with MAC addresses it automatically learns

Leads me to believe the oposite. This is probably where the confusion is arising from. My advice would be to set it up on one port and try it, see what happens, and you'll have a definitive answer, this vagueness is rather annoying.