Port Security - Automatic enable (HP 2920-24G PoE+ Switch, J9737A)

[marcbrunner]

Hi Guys

I want to prevent that end users connect third switches to the access switches. For this i use port-security with the following command.

port-security 1-23 address-limit 1 learn-mode limited-continuous action send-disable

It works fine. For Example if I connect a Switch with several Devices the port goes down.

In the next step I want to enable the port automatically if I connect an end device such as my Notebook again.

I didn't found any commands or descriptions for my problem.

Is there a possibility to do this? Is port-security the right way?

Kind Regards

Marc

[Chrisd131313]

Hi marcbrunner,

If you remove the "send-disable" option you should be able to block non-authorised devices but still allow authorised devices... Extract from Switch Acces Guide...

Blocking unauthorized traffic
Unless you configure the switch to disable a port on which a security violation is detected, the
switch security measures block unauthorized traffic without disabling the port. This implementation
enables you to apply the security configuration to ports on which hubs, switches, or other devices
are connected, and to maintain security while also maintaining network access to authorized users.

The other option is to use port-access (802.1x) so you can either use mac-based authentication or RADIUS authentication, this will allow devices to to added to a RADIUS client file or AD and authentication is tyhen based on those lsits, if the device does nto authentication successfuly it is dumped in to a unauth-vid, this way you are not shutting down the port and it will allow your authenticationed devices on to the network on a port that was earlier denied to an un-authenticated device. 

HTH

[marcbrunner]

Hello

I have the option "mac-adress" Configure the adress(es) authorized on the port(s). But that is not the solution because there needs to be an dynamic access list. It doesn't matter which MAC Adress it is. its abaout how many are allowed.

Are there any other possibilities?

Kind Regards

Marc

[Chrisd131313]

If it's just about quantity of MAC address on a single port then you can set the device limit on that specific port...

 port-security <port> address-limit <1- 64>.