Port security mode lock | secure permanent issue 35XX

Question

Hi all. I'm trying to configure port security on our Dell 35XX switches here at the office. Up till now I've been using 'max-addresses' mode to learn up to the maximum amount and disable if security was tripped. This was fine until I realized that upon disconnecting from the port and the interface goes down/down that the learned MACs are forgotten leaving the port available for connection.   So upon realizing this I decided to go the route of using mode 'lock' to make sure the learned addresses would remain cached even if the port went down. This appeared to work and the addresses did remain after the port went down, but I ran in to an interesting problem.   So a quick summary of connectivity at the desktop. From the drop we connect to a phone and then to the PC via the phone. We are utilizing the voice VLAN and it works well. So PCs are on one VLAN, phones on another.   So, the issue. After configuring the port the phone is unable to communicate on the VLAN. The workstation has no problem. I should add that currently the workstation is in the untagged [native] VLAN, while the phone is in a tagged VLAN. I recreated the issue across several different drops on different switched to be sure it wasn't an issue with the switch, drop, etc. I verify that the phone is being recognized and placed in the correct vlan with the 'show bridge address table ethernet eth#' command. Without the 'lock' mode the phone sees the network without any problem and is able to communicate.  What am I missing?!!

abpanda · Answer

Hi Daniel. Correct, before setting the 'lock' option the phones work without issue. It is only after setting the mode to 'lock' or 'secure permanent' that the phones are unable to communicate on the network.   Not sure what you mean when you say 'limited' dynamic lock?  Here's the configuration I'm attempting:  dot1x multiple-hosts port sec max 3 port security mode lock [or secure permanent] port sec discard-shutdown  r/Andrew

abpanda · Answer

I saw that mentioned in the CLI reference but the command is not recognized by the switch.  Running SW ver 2.0.0.52. I tried it on 2.0.0.40 with the same result.

abpanda · Answer

So I went through the GUI. It appears that Limited Dynamic Lock = mode Max-addresses via the command line. So that would put me back at square one.

abpanda · Answer

I appreciate it. At the moment, the dynamic lock will work but I'd like to be able to lock the port down further.

We are using Polycom/Soundpoint IP450s. Unfortunately I don't have other models to test with.

Hopefully we can work together to get to the bottom of this.

Thanks again.

abpanda · Answer

Hi Daniel,

I'm looking in to upgrading our firmware right now. Were out of date as of the last version which was just released. There isn't anything in particular in the upgrade release notes about the problem, but I'll let you know what I find out.

Thanks

Networking General

Was this post helpful?