Cisco IE-5000 User Manual

449
Configuring Port-Based Traffic Control
Information About Port-Based Traffic Control
Protected Ports
Some applications require that no traffic be forwarded at Layer 2 between ports on the same switch so that one neighbor
does not see the traffic generated by another neighbor. In such an environment, the use of protected ports ensures that
there is no exchange of unicast, broadcast, or multicast traffic between these ports on the switch.
Protected ports have these features:
 A protected port does not forward any traffic (unicast, multicast, or broadcast) to any other port that is also a
protected port. Data traffic cannot be forwarded between protected ports at Layer 2; only control traffic, such as PIM
packets, is forwarded because these packets are processed by the CPU and forwarded in software. All data traffic
passing between protected ports must be forwarded through a Layer 3 device.
 Forwarding behavior between a protected port and a nonprotected port proceeds as usual.
Protected Port Configuration Guidelines
You can configure protected ports on a physical interface (for example, Gigabit Ethernet port 1) or an EtherChannel group
(for example, port-channel 5). When you enable protected ports for a port channel, it is enabled for all ports in the
port-channel group.
Do not configure a private-VLAN port as a protected port. Do not configure a protected port as a private-VLAN port. A
private-VLAN isolated port does not forward traffic to other isolated ports or community ports.
Port Blocking
By default, the switch floods packets with unknown destination MAC addresses out of all ports. If unknown unicast and
multicast traffic is forwarded to a protected port, there could be security issues. To prevent unknown unicast or multicast
traffic from being forwarded from one port to another, you can block a port (protected or nonprotected) from flooding
unknown unicast or multicast packets to other ports.
Note: With multicast traffic, the port blocking feature blocks only pure Layer 2 packets. Multicast packets that contain
IPv4 or IPv6 information in the header are not blocked.
Port Security
You can use the port security feature to restrict input to an interface by limiting and identifying MAC addresses of the
stations allowed to access the port. When you assign secure MAC addresses to a secure port, the port does not forward
packets with source addresses outside the group of defined addresses. If you limit the number of secure MAC addresses
to one and assign a single secure MAC address, the workstation attached to that port is assured the full bandwidth of
the port.
If a port is configured as a secure port and the maximum number of secure MAC addresses is reached, when the MAC
address of a station attempting to access the port is different from any of the identified secure MAC addresses, a security
violation occurs. Also, if a station with a secure MAC address configured or learned on one secure port attempts to
access another secure port, a violation is flagged.
Secure MAC Addresses
You configure the maximum number of secure addresses allowed on a port by using the switchport port-security
maximum value interface configuration command.
Note: If you try to set the maximum value to a number less than the number of secure addresses already configured on
an interface, the command is rejected.
The switch supports these types of secure MAC addresses:

Cisco IE-5000 Specifications

General

Brand	Cisco
Model	IE-5000
Category	Switch
Language	English