Brocade BigIron RX Series Configuration Guide - Manual (Page 1111)

BigIron RX Series Configuration Guide 1033
53-1002484-04
Configuring the MAC Port Security feature
33
Autosaving secure MAC addresses to the startup-config
The autosave attribute allows the device to learn secure MAC addresses dynamically then add
them to the list of secure MAC addresses. The learned MAC addresses are automatically saved to
the startup-config file at specified intervals. These addresses remain persistent after a reboot.
For example, to specify the device to save dynamically learned secure MAC addresses every twenty
minutes, enter the following commands.
BigIron RX(config)# interface ethernet 7/11
BigIron RX(config-if-e100-7/11)# port security
BigIron RX(config-port-security-e100-7/11)# autosave 20
Syntax: [no] autosave <minutes>
You can specify 15 – 1440 minutes. By default, secure MAC addresses are not autosaved to the
startup-config file.
Setting the MAC Port Security age timer
By default, the learned MAC addresses stay secure indefinitely. The entries are cleared only when
MAC Port Security is disabled or a clear port-secure command is issued.
You can optionally configure the device to age out secure MAC addresses after a specified amount
of time.
To set the MAC Port Security age timer to 10 minutes globally, enter commands such as the
following.
BigIron RX(config)# global-port security
BigIron RX(config-port-security)# age 10
To set the MAC Port Security age timer to 10 minutes on a specific interface, enter commands such
as the following.
BigIron RX(config)# interface ethernet 7/11
BigIron RX(config-if-e100-7/11)# port security
BigIron RX(config-port-security-e100-7/11)# age 10
Syntax: [no] age <minutes>
The default is 0 (never age out secure MAC addresses).
Secure MAC addresses and deny MAC addresses are removed from the MAC address table after
the age timer elapses and no traffic is received from those MAC addresses on an interface.
However, if traffic from the MAC address is received, the following occurs:
• Secure MAC addresses on an interface and at the global level remain in the MAC table as long
as traffic with that address is received. However, it is removed from the MAC table and the
running-config if the age timer elapses and no traffic has been received from the MAC address.
• Deny MAC addresses are removed from the MAC address table globally after the age timer
elapses, even if traffic from the interface is received. Once traffic with the MAC address stops,
then the deny MAC address is removed from the running-config after the next age timer
elapses.