Filter
Top Products
43-3
Software Configuration Guide—Release 15.0(2)SG
OL-23818-01
Chapter 43 Configuring Port Security
About Port Security
About Port Security
Port security enables you to restrict the number of MAC addresses (termed secure MAC addresses) on a
port, allowing you to prevent access by unauthorized MAC addresses. It also allows you to configure a
maximum number of secure MAC addresses on a given port (and optionally for a VLAN for trunk ports).
When a secure port exceeds the maximum, a security violation is triggered, and a violation action is
performed based on the violation action mode configured on the port.
If you configure the maximum number of secure MAC addresses as 1 on the port, the device attached to
the secure port is assured sole access to the port.
If a secure MAC address is secured on a port, that MAC address is not allowed to enter on any other port
off that VLAN. If it does, the packet is dropped unnoticed in the hardware. Other than using the interface
or port counters, you do not receive a log message reflecting this fact. Be aware that this condition does
not trigger a violation. Dropping these packets in the hardware is more efficient and can be done without
putting additional load on the CPU.
Port security has the following characteristics:
• It allows you to age out secure MAC addresses. Two types of aging are supported: inactivity and
absolute.
• It supports a sticky feature whereby the secure MAC addresses on a port are retained through switch
reboots and link flaps.
• It can be configured on various types of ports such as access, voice, trunk, EtherChannel, and private
VLAN ports.
This overview contains the following topics:
• Secure MAC Addresses, page 43-4
• Maximum Number of Secure MAC Addresses, page 43-4
• Aging Secure MAC Addresses, page 43-5
• Sticky Addresses on a Port, page 43-5
• Violation Actions, page 43-6
switchport port-security mac-address
sticky
Enables sticky Port Security. Sticky Addresses on a Port,
page 43-5
no switchport port-security
mac-address sticky
Converts a sticky secure MAC
address to a dynamic MAC secure
address.
Configuring Port Security on Access
Ports, page 43-7
switchport port-security maximum Sets the maximum number of secure
MAC addresses for an interface.
Example 1: Setting Maximum
Number of Secure Addresses,
page 43-11
switchport port-security violation Sets the violation mode. Example 2: Setting a Violation
Mode, page 43-11
no switchport port-security violation Sets the violation mode. Configuring Port Security on Access
Ports, page 43-7
switchport trunk encapsulation dot1q Sets the encapsulation mode to
dot1q.
Example 1: Configuring a Maximum
Limit of Secure MAC Addresses for
All VLANs, page 43-19
Command Purpose Navigation