Cisco 2950 - Catalyst Switch - Configuring Port Blocking; Blocking Flooded Traffic on an Interface

22-5
Catalyst 2950 and Catalyst 2955 Switch Software Configuration Guide
78-11380-10
Chapter 22 Configuring Port-Based Traffic Control
Configuring Port Blocking
Beginning in privileged EXEC mode, follow these steps to define a port as a protected port:
To disable protected port, use the no switchport protected interface configuration command.
This example shows how to configure a port as a protected port:
Switch# configure terminal
Switch(config)# interface fastethernet0/1
Switch(config-if)# switchport protected
Switch(config-if)# end
Configuring Port Blocking
By default, the switch floods packets with unknown destination MAC addresses to all ports. If unknown
unicast and multicast traffic is forwarded to a protected port, there could be security issues.
To prevent unknown unicast or multicast traffic from being forwarded from one port to another, you can
configure a port (protected or nonprotected) to block unknown unicast or multicast packets.
Note Blocking unicast or multicast traffic is not automatically enabled on protected ports; you must explicitly
configure it.
The port blocking feature is only supported on these switches:
• Catalyst 2950 Long-Reach Ethernet (LRE) switches running Cisco IOS Release 12.1(14)EA1
or later
• Catalyst 2950G-12-EI, 2950G-24-EI, 2950G-24-EI-DC, 2950G-48-EI, and 2955 switches running
Cisco IOS Release 12.1(19)EA1 or later
Blocking Flooded Traffic on an Interface
Note The interface can be a physical interface or an EtherChannel group. When you block multicast or unicast
traffic for a port channel, it is blocked on all ports in the port channel group.
Command Purpose
Step 1
configure terminal Enter global configuration mode.
Step 2
interface interface-id Specify the interface to configure and enter interface
configuration mode.
Step 3
switchport protected Configure the interface to be a protected port.
Step 4
end Return to privileged EXEC mode.
Step 5
show interfaces interface-id switchport Verify your entries.
Step 6
copy running-config startup-config (Optional) Save your entries in the configuration file.