Configuring Learned Port Security Learned Port Security Overview
OmniSwitch AOS Release 8 Network Configuration Guide December 2017 page 33-6
• Allow MAC movement. When this option is enabled, a pseudo-static MAC address learned on one
port can move to another port in the same VLAN without getting dropped.
• Automatically learn MAC addresses as static MAC addresses. When this option is enabled, learned
MAC addresses are automatically converted to static MAC addresses during the learning window time.
MAC Address Types
There are four types of MAC addresses that are the result of or involved with the LPS port configuration
and operation:
• Static. A user-configured MAC address on the LPS port.
• Pseudo Static. A dynamically learned MAC address that is treated the same as a regular static address
(will not age out). However, pseudo-static MAC addresses are not saved in the running configuration
of the switch.
• Dynamic Brdiged. MAC address that are dynamically learned as bridged addresses up to the
maximum number of brdiged addresses allowed on the LPS port. When this maximum is reached,
subsequent addresses are dynamically learned as filtered MAC addresses.
• Dynamic Filtered. MAC addresses that are dynamically learned as filtered address up to the
maximum number of filtered addresses allowed on the LPS port.
How LPS Authorizes Source MAC Addresses
When a packet is received on a port that has LPS enabled, switch software checks specific criteria to
determine if the source MAC address contained in the packet is allowed on the port. The following chart
depicts the flow of the MAC address as various LPS rules are applied to determine whether or not the
address is learned on the port and the state of the address on that port (bridged or filtered):
Is the learning
Filtered MAC
address count
reached?
Is the no aging
YES
NO
YES
YES
NO
NO
YES
window open?
Bridged MAC
address count
reached?
Is MAC address
within authorized
range?
NO
option enabled?
MAC address learned as
a dynamic bridged address
MAC address learned as
a pseudo-static address
YES
NO
MAC address learned as
a dynamic filtered address
Drop packet, send trap,
disable port or restrict
unlearned packet
To Next Page
Loading...
Need help?
General
