I'm currently working with Alcatel OmniSwitch 6250 switches and I was asked to find a blocking method so that an access point can only be plugged on one port of the 24 available.

I looked at the "CLI Reference Guide" and found a "port-security" command that could have done the trick but doesn't match with what I need to achieve.

Does anyone know another method to do what I'm looking for ?


P.S : Why can't I say "Hi" or "Hello" ? It keeps getting erased when I send the message.

  • Did any of the answers help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively you can answer your own question and accept the answer.
    – Ron Maupin
    Aug 6, 2017 at 2:33

4 Answers 4


If you are not using any Network Management Systems that can support things like Policies or using 802.1x with a NAC, I think you are only going to be able to use port security and lock it by source MAC.

So basically what you want to do is, tell the switch that on Port X, only devices with a MAC source of X is allowed to use the port.

Configures a single authorized source MAC addre ss for a port that belongs to a specified VLAN.

port-security slot/port mac mac_address [vlan vlan_i]

You might want to look at the action that is taken when the port detects a MAC address that is not authorized so you can tell the switch to disable the port or simply alert only, so that it can sent a SNMP trap.

Please be mindful that this isn't 100% secure as any user with technical know-how, will be able to change their MAC address to the one specified and still get access.

Alternatively what you could also do, if you are using a specific VLAN for the access points, disable any form of DHCP for this VLAN and statically assign the IP addresses to your access points. And if a user does try to get on that particalular port, without DHCP they will be stuck. Unless, of course they are clever enough to know whatIP range to assign themselves, including gateway, etc.

Hope this helps you on your quest.


  • Thank you for your answer SleepyMan. Much appreciated. I have seen that "port-security" command but the matter is that this applies only on one port and I have to block the device (AP) on every port but one. And the other ports must continue to accept other devices (PC, printers, ...) in the meantime. The thing is : an AP must be plugged on a specific port. If it comes to be unplugged and plugged on another port, nothing should happen (no DHCP, VLAN, ...). Totally blocked. I've looked into the CLI Guide and found some QoS/ACL stuff that might do the trick. I have to investigate more. Aug 8, 2016 at 18:43
  • Port-Security for a given MAC address will only be useful if that AP exposes a single MAC (and probably IP) address towards the switch port, and has some form of tunneling (CAPWAP-style) to a WLAN Controller. If the AP operates in a mode where it bridges the SSIDs (and thus the WLAN client's MAC addresses) to its LAN interface (irrelevant if on the same or on a (set of) different VLAN(s)), port-security is going to see multiple MAC addresses on the given port and will take appropriate action. Jul 26, 2018 at 7:19

Another option is to ensure it's only plugged into one particular port is to make the port drop when it sees a BPDU coming from the attached host. You would enable this on all the ports that shouldn't have the access point attached.

In cisco terms, this feature is called bpduguardand the port will go into an err-disabled state when a bpdu is seen. You can set it such that the port will auto re-enable after a specified time and if the device is no longer attached the port will become operational again. errdisable recovery interval <seconds>

As for Alcatel, I'm not too familiar with them but a quick search turns up the following similar code:

qos no user-port filter user-port shutdown bpdu
policy port group UserPorts 1/10-24
qos apply

You would not set this on the port the access point is plugged into.

  • 1
    Stupid question on my part maybe, but do WAPs generally send BPDU frames at all? I've never given it much thought.
    – Stuggi
    Jan 3, 2018 at 7:40
  • AP's usually don't send BPDUs, unless they act as bridges. In general, that's something you have to make them do explicitely - if at all possible. Jul 26, 2018 at 7:13

I'm not sure why you would want to do this, but you could try adding a static entry in the mac-address table: mac-address-table [permanent] mac_address {slot/port | linkagg link_agg} vid [bridging | filtering]


is the acces point in tunnel mode or direct connected en injecting traffic into vlan's?

you could disable the lanpower on all but one port:

lanpower start 1
lanpower stop 1/1
lanpower stop 1/2

or you could try 802.1x/mac based authentication with a radius server, but its a bit more complex. It's called 'Access Guardian' by alcatel lucent

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.