9-20
Configuring and Monitoring Port Security
MAC Lockdown
MAC Lockdown, on the other hand, is not a “list.” It is a global parameter on
the switch that takes precedence over any other security mechanism. The
MAC Address will only be allowed to communicate using one specific port on
the switch.
MAC Lockdown is a good replacement for port security to create tighter
control over MAC addresses and which ports they are allowed to use (only
one port per MAC Address on the same switch in the case of MAC Lockdown).
(You can still use the port for other MAC addresses, but you cannot use the
locked down MAC address on other ports.)
Using only port security the MAC Address could still be used on another port
on the same switch. MAC Lockdown, on the other hand, is a clear one-to-one
relationship between the MAC Address and the port. Once a MAC address has
been locked down to a port it cannot be used on another port on the same
switch.
The switch does not allow MAC Lockdown and port security on the same port.
MAC Lockdown Operating Notes
Limits. There is a limit of 500 MAC Lockdowns that you can safely code per
switch. To truly lock down a MAC address it would be necessary to use the
MAC Lockdown command for every MAC Address and VLAN ID on every
switch. In reality few network administrators will go to this length, but it is
important to note that just because you have locked down the MAC address
and VID for a single switch, the device (or a hacker “spoofing” the MAC
address for the device) may still be able to use another switch which hasn’t
been locked down.
Event Log Messages. If someone using a locked down MAC address is
attempting to communicate using the wrong port the “move attempt” gener-
ates messages in the log file like this:
Move attempt (lockdown) logging:
W 10/30/03 21:33:43 maclock: module A: Move 0001e6-1f96c0
to A15 denied
W 10/30/03 21:33:48 maclock: module A: Move 0001e6-1f96c0
to A15 denied
W 10/30/03 21:33:48 maclock: module A: Ceasing move-denied
logs for 5m
To Next Page
Loading...
Need help?
General
