Cisco Catalyst 4500 Series Configuration Guide

47-3
Software Configuration Guide—Release IOS XE 3.3.0SG and IOS 15.1(1)SG
OL-25340-01
Chapter 47 Configuring Port Security
About Port Security
About Port Security
Port security enables you to restrict the number of MAC addresses (termed secure MAC addresses) on a
port, allowing you to prevent access by unauthorized MAC addresses. It also allows you to configure a
maximum number of secure MAC addresses on a given port (and optionally for a VLAN for trunk ports).
When a secure port exceeds the maximum, a security violation is triggered, and a violation action is
performed based on the violation action mode configured on the port.
If you configure the maximum number of secure MAC addresses as 1 on the port, the device attached to
the secure port is assured sole access to the port.
If a secure MAC address is secured on a port, that MAC address is not allowed to enter on any other port
off that VLAN. If it does, the packet is dropped unnoticed in the hardware. Other than using the interface
or port counters, you do not receive a log message reflecting this fact. Be aware that this condition does
not trigger a violation. Dropping these packets in the hardware is more efficient and can be done without
putting additional load on the CPU.
Port security has the following characteristics:
• It allows you to age out secure MAC addresses. Two types of aging are supported: inactivity and
absolute.
• It supports a sticky feature whereby the secure MAC addresses on a port are retained through switch
reboots and link flaps.
• It can be configured on various types of ports such as access, voice, trunk, EtherChannel, and private
VLAN ports.
This overview contains the following topics:
• Secure MAC Addresses, page 47-4
• Maximum Number of Secure MAC Addresses, page 47-4
• Aging Secure MAC Addresses, page 47-5
• Sticky Addresses on a Port, page 47-5
• Violation Actions, page 47-6
switchport port-security mac-address
sticky
Enables sticky Port Security. Sticky Addresses on a Port,
page 47-5
no switchport port-security
mac-address sticky
Converts a sticky secure MAC
address to a dynamic MAC secure
address.
Configuring Port Security on Access
Ports, page 47-7
switchport port-security maximum Sets the maximum number of secure
MAC addresses for an interface.
Example 1: Setting Maximum
Number of Secure Addresses,
page 47-11
switchport port-security violation Sets the violation mode. Example 2: Setting a Violation
Mode, page 47-11
no switchport port-security violation Sets the violation mode. Configuring Port Security on Access
Ports, page 47-7
switchport trunk encapsulation dot1q Sets the encapsulation mode to
dot1q.
Example 1: Configuring a Maximum
Limit of Secure MAC Addresses for
All VLANs, page 47-19
Command Purpose Navigation

Cisco Catalyst 4500 Series Specifications

General

Series	Catalyst 4500 Series
Category	Switch
Layer Support	Layer 2, Layer 3
Form Factor	Modular chassis
Stackable	No
Chassis Slots	3, 6, 7, 10
Power Supply Options	AC, DC
Redundancy	Power supply, Supervisor engine
Network Management	Cisco IOS Software CLI, SNMP, Cisco Prime Infrastructure
Features	Security, QoS
Port Density	Up to 384 ports per chassis
Security Features	802.1X, ACLs, DHCP Snooping, Dynamic ARP Inspection, IP Source Guard
Supervisor Engine	8-E