ArubaOS-CX Port Security: MAC Lockout and Client Limits

An ArubaOS-CX access port that allows unlimited MAC learning is an open door: an attacker can flood the forwarding table with random source addresses, exhaust DHCP leases, or simply plug an unauthorised laptop into a wall jack. AOS-CX gives you two complementary controls. Port-access client limits cap how many devices can authenticate or be learned on an interface, and MAC lockout blocks specific addresses outright. Used together with sticky learning, they lock down an access edge without needing a full 802.1X deployment. This article covers the CLI for each control, the interactions between them, and how to verify that the switch is actually enforcing them.

Choosing the Right Control

AOS-CX does not use the classic switchport port-security model found on Cisco Catalyst. Instead, enforcement comes from the port-access feature set:

• Client limits cap the number of authenticated clients per interface and per system — the cleanest defence against MAC floods on an 802.1X edge.
• MAC lockout statically denies a specific MAC address everywhere in the switch, which is useful for blackholing a known-bad device.
• Sticky MAC learning converts dynamically learned addresses into static entries so that a moved device triggers a violation instead of silently re-learning.
• MAC limiting per interface constrains the size of the forwarding table on a port, which is the direct answer to learning-table overflow.

Configure a Per-Port Client Limit

Client limits live under the port-access configuration and are applied either globally or per interface. Global limits protect the whole switch, while interface limits are stricter for user-facing ports:

switch(config)# port-access client-limit 1
switch(config)# port-access client-limit 1 interface 1/1/1-1/1/24
switch(config)# port-access client-limit 2 interface 1/1/25

If you want to allow one MAC address and reject everything else, set the limit to 1 on the port and combine it with sticky learning:

switch(config)# port-access sticky-mac 1/1/1
switch(config)# port-access sticky-mac 1/1/2
show port-access clients

Sticky MAC learning and hardware replacement

With sticky learning enabled, the first address learned on the port is written into the running configuration as a static entry. Replacing the device requires an administrator to clear the entry, which is exactly the behaviour you want on a server port or a meeting-room jack.

Lock Out a Specific MAC Address

MAC lockout is a global, address-based deny list. It is not tied to a port, so it follows the device wherever it is plugged in:

switch(config)# mac-lockout 00:11:22:33:44:55
switch(config)# mac-lockout 00:11:22:33:44:56
show mac-lockout

The same address can later be removed, and the switch will start learning it again on whichever port it appears:

switch(config)# no mac-lockout 00:11:22:33:44:55

Limit MAC Learning on an Interface

For pure Layer 2 learning-table overflow protection, AOS-CX provides a per-interface MAC limit:

switch(config)# interface 1/1/10
switch(config-if)# mac-limit 5
switch(config-if)# exit

Combine this with a violation action where supported so that an offending port is either blocked or disabled rather than merely logging. On platforms that offer only logging, forward the event to your syslog collector and alert on the mnemonic — silent drops on a port that keeps learning are hard to spot otherwise.

Verify Enforcement

The verification commands differ per feature, and each one answers a different question:

show port-access clients
show port-access clients interface 1/1/1
show mac-address-table
show mac-address-table interface 1/1/10
show mac-lockout
show running-config | include "port-access|mac-limit|mac-lockout"
show events -d port-access

Reading the verification output

Read the output like this. If show port-access clients shows fewer clients than expected, the limit is working — check the event log for the rejection reason. If show mac-address-table shows addresses on a port you configured with mac-limit, confirm the limit is applied to the correct interface number; interface naming on AOS-CX uses member/slot/port, and a typo silently configures a non-existent port.

Operational Notes

• Client limits are the correct control for an 802.1X edge; MAC limits are the correct control for learning-table overflow.
• Sticky MAC entries are saved in the configuration — plan for an admin workflow to clear them when hardware is replaced.
• MAC lockout is global and address-based, so a typo can block a legitimate device anywhere in the switch.
• Always pair blocking with logging, and ship the port-access event log to a collector so that violations leave a trail.

Related reading: our ArubaOS-CX ACL configuration guide, the AOS-CX DHCP snooping configuration article, and the AOS-CX loop protect verification guide.

原文链接：https://arubanetworking.hpe.com/techdocs/AOS-CX/10.16/PDF/security_5420-6200-6300-6400.pdf