Configure Ethernet Port Security

To define a profile's Ethernet port security configuration:

  1. Select the Security tab.
    Click to expand in new window
    Interface GE Port - Security Tab
    GUID-C2631832-60A8-4552-BB44-94A18BEF573E-low.png
  2. Refer to the Access Control field. As part of the port's security configuration, Inbound IP and MAC address firewall rules are required.

    Use the Inbound IP Firewall Rules and MAC Inbound Firewall Rules pull-down menus to select the firewall rules to apply to this profile's Ethernet port configuration.

    The firewall inspects IP and MAC traffic flows and detects attacks typically not visible to traditional wired firewall appliances.

  3. If a firewall rule does not exist suiting the data protection needs of the target port configuration, select the Create icon to define a new rule configuration. For more information, see Wireless Firewall.
  4. Refer to the Trust field to define the following:
    Trust ARP Responses Select the check box to enable ARP trust on this port. ARP packets received on this port are considered trusted and information from these packets is used to identify rogue devices within the network. The default value is disabled.
    Trust DHCP Responses Select the check box to enable DHCP trust on this port. If enabled, only DHCP responses are trusted and forwarded on this port, and a DHCP server can be connected only to a DHCP trusted port. The default value is enabled.
    ARP header Mismatch Validation Select this option to enable a mismatch check for the source MAC in both the ARP and Ethernet header. The default value is disabled.
    Trust 802.1p COS values Select the check box to enable 802.1p COS values on this port. The default value is enabled.
    Trust IP DSCP Select the check box to enable IP DSCP values on this port. The default value is enabled.
    Note: Some vendor solutions with VRRP enabled send ARP packets with Ethernet SMAC as a physical MAC and inner ARP SMAC as VRRP MAC. If this configuration is enabled, a packet is allowed, despite a conflict existing.
  5. Set the following IPv6 Settings:
    Trust ND Requests Select this option to enable the trust of neighbor discovery requests required on an IPv6 network on this Ethernet port. This option is disabled by default.
    Trust DHCPv6 Responses Select this option to trust all DHCPv6 responses on this Ethernet port. DHCPv6 is a networking protocol for configuring IPv6 hosts with IP addresses, IP prefixes, or other configuration attributes required on an IPv6 network. This option is enabled by default.
    ND Header Mismatch Validation Select this option to enable a mismatch check for the source MAC within the ND header and Link Layer Option. This option is disabled by default.
    RA Guard Select this option to enable router advertisements or ICMPv6 redirects from this Ethernet port. This option is enabled by default.
  6. Set the following 802.1X Settings:
    Host Mode Use the drop-down menu to select the host mode configuration to apply to this port. Options include single-host or multi-host. The default setting is single-host.
    Guest VLAN Specify a guest VLAN for this port from 1 - 4094. This is the VLAN traffic is bridged on if this port is unauthorized and the guest VLAN is globally enabled.
    Port Control Use the drop-down menu to set the port control state to apply to this port. Options include force-authorized, force-unauthorized and automatic. The default setting is force-authorized.
    Re Authenticate Select this setting to force clients to re-authenticate on this port. The default setting is disabled, thus clients do not need to re-authenticate for connection over this port until this setting is enabled.
    Max Reauthenticate Count Set the maximum re-authentication attempts (1 - 10) before this port is moved to unauthorized. The default setting is 2.
    Maximum Request Set the maximum number of authentication requests (1 - 10) before returning a failed message to the requesting client. The default setting is 2.
    Quiet Period Set the quiet period for this port from 1 - 65,535 seconds. This is the maximum wait time 802.1x waits upon a failed authentication attempt. The default setting is 60 seconds.
    Reauthenticate Period Use the spinner control to set the re-authentication period for this port from 1 - 65,535 seconds. The default setting is 60 seconds.
    Port MAC Authentication When enabled, a port's MAC address is authenticated, as only one MAC address is supported per wired port. When successfully authenticated, packets from the source are processed. Packets from all other sources are dropped.

    Port MAC authentication may be enabled on ports in conjunction with Wired 802.1x settings for a MAC Authentication AAA policy.

  7. Select Enable within the 802.1x supplicant (client) feature field to enable a username and password pair used when authenticating users on this port. This setting is disabled by default.
    Note

    Note

    The password cannot exceed 32 characters.
  8. Select OK to save the changes made to the Ethernet port's security configuration. Select Reset to revert to the last saved configuration.
9036513-00 Rev AA