Allied Telesis AT-S95 WEB - Manual (Page 67)

Configuring Device Security
Configuring Network Security
Page 67
Port-based authentication provides traditional 802.1x support, as well as, Guest VLANs. Guest VLANs limited
network access to authorized ports. If a port is denied network access via port-based authorization, but the Guest
VLAN is enabled, the port receives limited network access. For example, a network administrator can use Guest
VLANs to deny network access via port-based authentication, but grant Internet access to unauthorized users.
This section contains the following topics:
• Managing Port Security
• Defining 802.1x Port Access
• Enabling Storm Control
Managing Port Security
Network security can be increased by limiting access on a specific port only to users with specific MAC addresses.
The MAC addresses can be dynamically learned or statically configured. Locked port security monitors both
received and learned packets that are received on specific ports. Access to the locked port is limited to users with
specific MAC addresses. These addresses are either manually defined on the port, or learned on that port up to
the point when it is locked. When a packet is received on a locked port, and the packet source MAC address is not
tied to that port (either it was learned on a different port, or it is unknown to the system), the protection mechanism
is invoked (unless it is statically configured on another port, or was learned/configured on another secured port),
and can provide various options. Unauthorized packets arriving at a locked port are handled by one of the
following actions:
• Forwarded with or without a trap, but the source address is not learned on the port.
• Discarded with or without a trap.
• The port is shut down with or without a trap.
Locked port security also enables storing a list of MAC addresses in the configuration file. The MAC address list
can be restored after the device has been reset. Disabled ports are activated from the Port Security Page.
The Port Security Page enhances network security by providing port locking management to network
administrators.