Port Security Problem

[Aji B. Brillantes]

I have a procurve egde switches and I enabled the port security using the command "port-security xx learn-mode static action send-disable address-limit 1" (where xx is the port). The problem is when I clear the intrusion flags and enable the port the PC connected to it still can't get an IP. Can you teach me howto configure port security properly and howto enable the port again. Thanks!

[Matt Hobbs]

Is the port disabling itself again straight away? It sounds like you may have more than 1 mac-address on that port.

If you simply just re-enable the port, it should operate as normal. It is only when you clear the intrustion flag that it is ready again to disable itself if there is a port-security violation.

[Mohieddin Kharnoub]

Hi

Since you want to lock the port for one address, AND if you know the MAC address in advance, lockout is preferable to relying upon port-security to stop access from known devices because it can be blocked for all ports on the switch with one command.

To be more Dynamic, use Limited option with Port Security:

port-security [port list] learn-mode limited [address-limit X] [action (none | send-alarm | send-disable)]

example: port-security A1,A3-A5 learn-mode limited address-limit 4 action send-disable

Note:
If Port is disabled from an intrusion; after the port is reenabled,the port will not disable itself after another intrusion

So be sure to reset the intrusion flag.


Don't forget to assign points my dear.

Good Luck !!!

[Aji B. Brillantes]

Thanks for your help. The scenario is like this, 2 PC connected to a switch, PC1 connected to port 1 and PC2 connected to port 2. PC1 was removed from the switch and a new PC(PC3) was connected to port 1. Port 1 was disbaled after I connect PC3 on port 1. my problem is that port 1 keeps on disbaling after I enable it. and when I checked port 1 the mac address of PC1 is still there.

[Aji B. Brillantes]

I enabled the port without clearing the intrustion flag, but the New PC connected to it cannot get an ip (limited connection) and when I configured it with a static IP is still cannot connect to te network.

[Aji B. Brillantes]

May be the problem is with the mac address of the old PC connected to the port. How do I clear again the port from the old mac address?

[Mohieddin Kharnoub]

My dear

If you have enabled Port Security as you mentioned before, then:

- Disconnect PC3.
- Go to the switch by the Web interface or CLI.
- Enbale the Port.
- Then Clear the Intrusion Log.
- If you have configured PC1's Mac address, then change it to PC3's one.
- Confirm this with: show port-security [e] . --- you should not see under Authorized Addresses, the Mac for PC1 or others.


Now you connect PC3.

If it works, then don;t forget to issue Write Memory.

Good Luck !!!

[Aji B. Brillantes]

My problem is the switch and PC is located to a different building and I don't know the MAC address of PC3. Is there a fast way to clear the old mac address?

[Matt Hobbs · Accepted solution]

From the CLI:

Delete the address by using 'no port-security macaddress
.

For more information please refer to the port security chapter:

ftp://ftp.hp.com/pub/networking/software/Security-Oct2005-59906024-Chap09-Port_Security.pdf