PurposeCommand or Action
• shutdown—The interface is error-disabled when a violation occurs, and the
port LED turns off. An SNMP trap is sent, a syslog message is logged, and
the violation counter increments.
• shutdown vlan—Use to set the security violation mode per VLAN. In this
mode, the VLAN is error disabled instead of the entire port when a violation
occurs.
When a secure port is in the error-disabled state, you can bring it
out of this state by entering the errdisable recovery cause
psecure-violation global configuration command. You can manually
re-enable it by entering the shutdown and no shutdown interface
configuration commands or by using the clear errdisable interface
vlan privileged EXEC command.
Note
(Optional) Enters a secure MAC address for the interface. You can use this
command to enter the maximum number of secure MAC addresses. If you configure
switchport port-security
[mac-address mac-address [vlan
{vlan-id | {access | voice}}]
Step 8
fewer secure MAC addresses than the maximum, the remaining MAC addresses
are dynamically learned.
Example:
Switch(config-if)# switchport
If you enable sticky learning after you enter this command, the secure
addresses that were dynamically learned are converted to sticky secure
MAC addresses and are added to the running configuration.
Note
(Optional) vlan—sets a per-VLAN maximum value.
port-security mac-address
00:A0:C7:12:C9:25 vlan 3 voice
Enter one of these options after you enter the vlan keyword:
• vlan-id—On a trunk port, you can specify the VLAN ID and the MAC
address. If you do not specify a VLAN ID, the native VLAN is used.
• access—On an access port, specifies the VLAN as an access VLAN.
• voice—On an access port, specifies the VLAN as a voice VLAN.
The voice keyword is available only if a voice VLAN is configured on a
port and if that port is not the access VLAN. If an interface is configured
for voice VLAN, configure a maximum of two secure MAC addresses.
Note
(Optional) Enables sticky learning on the interface.switchport port-security
mac-address sticky
Step 9
Example:
Switch(config-if)# switchport
port-security mac-address sticky
(Optional) Enters a sticky secure MAC address, repeating the command as many
times as necessary. If you configure fewer secure MAC addresses than the
switchport port-security
mac-address sticky [mac-address |
vlan {vlan-id | {access | voice}}]
Step 10
maximum, the remaining MAC addresses are dynamically learned, are converted
to sticky secure MAC addresses, and are added to the running configuration.
Example:
Switch(config-if)# switchport
If you do not enable sticky learning before this command is entered, an
error message appears, and you cannot enter a sticky secure MAC address.
Note
(Optional) vlan—sets a per-VLAN maximum value.
port-security mac-address sticky
Catalyst 2960-XR Switch Security Configuration Guide, Cisco IOS Release 15.0(2)EX1
OL-29434-01 343
Configuring Port-Based Traffic Control
Enabling and Configuring Port Security
To Next Page
Loading...
Need help?
General
