Port Security

DL1689

Hi,

I am new to the Zyxel XGS1935-52HP managed switch. I wanted to limit access to one device for one port using MAC address. However, I couldn't find the option to do so.

According to google, using port security and set the learning number to 1 and it should work. I tried and the port just assigned another IP address. There is no option to choose what to do with subsequent new MAC address! It had that option in older switches.

What should I do to achieve one MAC address for one port and ignore all new MAC addresses? Please help.

My firmware version is 4.90. It's the latest for this switch.

Thanks in advance.

David

PeterUK

Well the option is there did you Active it on and Active for the given port to 1 Limited
Number of Learned MAC Address?

Another way is to limit by Classifier and Policy Rule if you know the given MAC

Zyxel_Tina

Hi @DL1689,

Welcome to the Zyxel Community!

To restrict a switch port to only one specific MAC address and block all other MAC addresses (without letting the port dynamically learn new ones), you can achieve this by configuring Port Security with Static MAC Forwarding.

By manually registering your authorized device's MAC address and turning off dynamic address learning on that port, the switch will strictly forward traffic only for your designated device and drop packets from any other device.

Here is how you can set this up on your XGS1935-52HP:

1. Configure Port Security on the Port

1. Navigate to SECURITY > Port Security.
2. Toggle the Port Security Active switch to Enable.
3. Find your target port in the table and configure it as follows:
   1. Active: Check this box to enable Port Security on the port. (This forces the port to only forward packets that match MAC addresses in the switch's MAC address table for this port, dropping unrecognized traffic).
   2. Address Learning: Uncheck this box. Disabling address learning stops the switch from dynamically learning and allowing other, unauthorized MAC addresses on this port.
   3. Limited Number of Learned MAC Address: Leave this at 0, as address learning is now disabled for this port.
4. Click Apply.

2. Bind the Authorized MAC Address to the Port

1. Navigate to SWITCHING > Static MAC Forwarding.
2. Click Add/Edit.
3. Configure the following settings:
   1. Active: Enable (turn on the switch button).
   2. Name: Enter a descriptive name (e.g., Authorized_Device).
   3. MAC Address: Enter the MAC address of the authorized device.
   4. VID: Enter the VLAN ID that this port/device belongs to (typically VLAN 1 if you are using the default VLAN).
   5. Port: Select the physical port number where this device is connected.
4. Click Apply.

3. Save Your Configuration

To ensure these settings persist after a switch reboot: Click the Save in the top-right corner of the web GUI.

Let us know how it goes!