Configuring MAC Locking
15-46 Security Configuration
Configuring MAC Locking
ThisfeaturelocksaMACaddresstooneormoreports,preventingconnectionofunauthorized
devicesthroughtheport(s).WhensourceMACaddressesarereceivedonspecifiedports,the
switchdiscardsallsubsequentframesnotcontainingtheconfiguredsourceaddresses.Theonly
framesforwardedona“locked”portarethosewiththe“locked”MACaddress(es)forthatport.
TherearetwomethodsoflockingaMACtoaport:firstarrivalandstatic.Thefirstarrivalmethod
isdefinedtobelockingthefirstnnumberofMACswhicharriveonaportconfiguredwithMAC
lockingenabled.Thevaluenisconfiguredwiththesetmaclockfirstarrivalcommand.
ThestaticmethodisdefinedtobestaticallyprovisioningaMACportlockusingthesetmaclock
command.ThemaximumnumberofstaticMACaddressesallowedforMAClockingonaport
canbeconfiguredwiththesetmaclockstaticcommand.
YoucanconfiguretheswitchtoissueaviolationtrapifapacketarriveswithasourceMAC
addressdifferentfromanyofthecurrentlylockedMACaddressesforthatport.
MACsareunlockedasaresultof:
•Alinkdownevent
•WhenMAClockingisdisabledonaport
•WhenaMACisagedoutoftheforwardingdatabasewhenFirstArrivalagingisenabled
Whenproperlyconfigured,MAClockingisanexcellentsecuritytoolasitpreventsMACspoofing
onconfiguredports.AlsoifaMACweretobesecuredbysomethinglikeDragonDynamic
IntrusionDetection,MAClockingwouldmakeitmoredifficultforahackertosendpacketsinto
thenetworkbecausethehackerwouldhavetochangetheirMACaddressandmovetoanother
port.Inthemeantimethesystemadministratorwouldbereceivingamaclocktrapnotification.
Purpose
Toreview,disable,enable,andconfigureMAClocking.
Commands
authenticated mac
address
If authentication has succeeded, displays the MAC address assigned for egress.
vlan id If authentication has succeeded, displays the assigned VLAN id for ingress.
Table 15-50 show vlanauthorization Output Details (Continued)
Output Field What It Displays...
For information about... Refer to page...
show maclock 15-47
show maclock stations 15-48
set maclock enable 15-49
set maclock disable 15-50
set maclock 15-50
clear maclock 15-51