I went through the manual and came up with the following configuration should be sane if you want to use port-security automatically (that is without having to manually add/remove allowed mac-addresses):
System-level:
port-security enable
port-security trap
port-security timer autolearn aging 5
Interface-level:
port-security intrusion-mode blockmac
port-security mac-address aging-type inactivity
port-security mac-address dynamic
port-security max-mac-count 10
port-security ntk-mode ntkonly
port-security port-mode autolearn
With the following comments:
System-level:
> port-security enable
This one is needed to enable port-security, otherwise interface-level configurations regarding port-security will be ignored (as I understand it).
> port-security trap
To get SNMP-traps when stuff happends with port-security. You can also limit this to only get for example intrusion traps. Default is no traps so if you dont want traps then dont configure this.
> port-security timer autolearn aging 5
You need to configure this (the above means 5mins, which matches regular mac-address learning which is 300 seconds (= 5mins)) if you want the "aging-type inactivity" to function, unless I misunderstood these lines from the manual?
"
If only an aging timer is configured, the aging timer counts up regardless of whether traffic data has been sent from the sticky MAC address. When you use an aging timer together with the inactivity aging function, the aging timer restarts once traffic data is detected from the sticky MAC address. The inactivity aging function prevents the unauthorized use of a secure MAC address when the authorized user is offline, and removes outdated secure MAC addresses so new secure MAC addresses can be learned.
"
Interface-level:
>port-security intrusion-mode blockmac
This will act as a srcmac filter. If the mac-address doesnt match the allowed list created by port-security the frame will be dropped. Other intrusion-modes is for example to shutdown the interface but thats more offensive against the user since that would affect all traffic, even already learned allowed mac-addresses.
>port-security mac-address aging-type inactivity
See comment above for "timer autolearn aging".
>port-security mac-address dynamic
Learned mac-addresses will be considered to be dynamic and not saved in the configuration file between reboots. However if you manually configure a static entry that static entry will survive reboots.
>port-security max-mac-count 10
Max number of allowed learned mac-addresses by the port-security.
>port-security ntk-mode ntkonly
If "intrusion-mode blockmac" is for incoming frames on the interface this is for outgoing frames:
"
By default, NTK is disabled on a port and all frames are allowed to be sent.
The need to know (NTK) feature checks the destination MAC addresses in outbound frames to allow
frames to be sent to only devices passing authentication, preventing illegal devices from intercepting
network traffic.
"
However im not sure what the proper setting would be here when you use autolearning - anyone with experience from this? Or isnt NTK valid when you use autolearn?
> port-security port-mode autolearn
Basically how port-security should function. The above will basically be in passive mode, that is no 802.1x or mac-authentication is involved.
