Port Security on HPE Aruba ArubaOS-Switch
How to configure port security on HPE Aruba ArubaOS-Switch — limiting MAC addresses per port, static MAC binding, dynamic learning lockdown, and clearing intrusion flags.
Port security is a form of MAC lockdown (layer 2 control). It lets you limit, restrict or fix the MAC addresses allowed on an individual switch port, and decide what the switch does when that rule is broken. This applies to the HPE Aruba 2920, 2930, 3800, 5400 and 8200 series running ArubaOS-Switch.
I wrote this after a reader asked how to set it up. These are the scenarios I use most.
Tip: Start with
action send-alarmwhen first deploying port security. This alerts your NMS (such as HPE IMC) without disrupting traffic, letting you validate before enforcing.
Learn modes #
| Learn mode | Behaviour |
|---|---|
continuous (default) | Any MAC address is learned as a device connects |
static | MAC addresses can be pre-defined; other addresses can also be learned |
configured | MAC addresses can be pre-defined; no other MAC addresses can be learned |
limited-continuous | MAC addresses are learned, up to the address-limit |
port-access | Used with 802.1x to temporarily learn the MAC address of an authenticated session |
Scenario 1 — Limit to 2 MACs, learn dynamically, disable on violation #
port-security 1-24 address-limit 2 learn-mode limited-continuous action send-disableAfter a violation, the switch waits the MAC age time (default 300 seconds) before learning new MACs. Check or adjust with:
show system-information
mac-age-time 60-999960Scenario 2 — Static MAC binding, disable on violation #
port-security 25 learn-mode configured mac-address 0000.ffff.0000 action send-disableScenario 3 — Sticky MAC learning, lock permanently #
port-security 25 learn-mode static action send-disableScenario 4 — Send alarm to NMS instead of disabling #
port-security 1-24 address-limit 2 learn-mode limited-continuous action send-alarmClear an intrusion flag #
port-security 1 clear-intrusion-flag