MAC locking helps prevent unauthorized access to the network by limiting access based on a device‘s MAC address. MAC locking enables the binding of specific MAC addresses to specific ports on a switch. MAC locking locks a port to one or more MAC addresses, preventing connection of unauthorized devices via a port. With MAC locking enabled, the only frames forwarded on a MAC locked port are those with the configured or dynamically selected MAC addresses for that port.
Frames received on a port with a Source MAC address not bound to the port are discarded or optionally allowed to dynamically bind to the port, up to a user-controlled maximum number of MAC addresses per port.
There are two different types of MAC locking:
• Static MAC locking - Locking one or more specified MAC addresses to a port.
• First Arrival MAC locking - Locking one or more MAC addresses to a port based on first arrival of received frames after First Arrival MAC locking is enabled. The configuration specifies the maximum number of end users that will be allowed. As each new end user is identified, it is MAC locked up to the maximum number of users. Once the maximum number of users has been MAC locked, all other users will be denied access to the port until a MAC locked address is either aged, if aging is configured, or the session for that user ends.
The MAC locking feature is disabled in the device, by default. MAC locking must be enabled both globally and on port level. Once enabled, ports can be configured for static and First Arrival MAC locking.
Existing limit learning and lock learning features are supported on a port-VLAN (Virtual LAN) combination. The MAC locking feature implemented in ExtremeXOS 15.7 supports MAC locking functionality on a port basis.
Print
this page
Email this topic
Feedback
View PDF
Download EPUB