OK, so if using the router admin I:
1. go to 'VLAN & Port Settings' -> 'Address Tables' -> 'Static' and add some VLAN/MAC/port triplets; then
2. go to 'Security' -> 'Traffic Control' (what the?!) -> 'Port Security' and set the learning mode to 'Classic Lock'
... then does the classic lock use the static address table to decide what is and is not allowed on that port?
(This is only implied in the switch documentation).
thanks,
David.