H3C Technologies H3C WX6000 Series Access Controllers - Manual (Page 150)

19-11
[AC-GigabitEthernet0/0/1] port-security intrusion-mode disableport-temporarily
[AC-GigabitEthernet0/0/1] quit
[AC] port-security timer disableport 30
2) Verify the configuration
After completing the above configurations, you can use the following command to view the port security
configuration information:
<AC> display port-security interface gigabitethernet 0/0/1
Equipment port-security is enabled
Intrusion trap is enabled
Disableport Timeout: 30s
OUI value:
GigabitEthernet0/0/1 is link-up
Port mode is autoLearn
NeedToKnow mode is disabled
Intrusion Protection mode is DisablePortTemporarily
Max MAC address number is 64
Stored MAC address number is 0
Authorization is permitted
As shown in the output, the maximum number of secure MAC addresses allowed on the port is 64, the
port security mode is autoLearn, the intrusion protection trap is enabled, and the intrusion protection
action is to keep the port temporarily (DisablePortTemporarily) for 30 seconds.
You can also use the above command repeatedly to track the number of MAC addresses learned by the
port, or use the display this command in Ethernet port view to display the secure MAC addresses
learned, as shown below:
<AC> system-view
[AC] interface gigabitethernet 0/0/1
[AC-GigabitEthernet0/0/1] display this
#
interface GigabitEthernet0/0/1
port-security max-mac-count 64
port-security port-mode autolearn
port-security mac-address security 0002-0000-0015 vlan 1
port-security mac-address security 0002-0000-0014 vlan 1
port-security mac-address security 0002-0000-0013 vlan 1
port-security mac-address security 0002-0000-0012 vlan 1
port-security mac-address security 0002-0000-0011 vlan 1
#
Issuing the display port-security interface command after the number of MAC addresses learned by
the port reaches 64, you will see that the port security mode has changed to secure. When any frame
with a new MAC address arrives, intrusion protection is triggered and you will see trap messages as
follows:
#May 2 03:15:55:871 2000 AC PORTSEC/1/VIOLATION:Traph3cSecureViolation
A intrusion occurs!
IfIndex: 9437207
Port: 9437207
MAC Addr: 0.2.0.0.0.21
VLAN ID: 1
IfAdminStatus: 1