C
HAPTER
25
| General Security Measures
Port Security
– 874 –
PORT SECURITY
These commands can be used to enable port security on a port.
When MAC address learning is disabled on an interface, only incoming
traffic with source addresses already stored in the dynamic or static
address table for this port will be authorized to access the network.
When using port security, the switch stops learning new MAC addresses on
the specified port when it has reached a configured maximum number.
Only incoming traffic with source addresses already stored in the dynamic
or static address table for this port will be authorized to access the
network. The port will drop any incoming frames with a source MAC
address that is unknown or has been previously learned from another port.
If a device with an unauthorized MAC address attempts to use the switch
port, the intrusion will be detected and the switch can automatically take
action by disabling the port and sending a trap message.
mac-learning This command enables MAC address learning on the selected interface. Use
the no form to disable MAC address learning.
SYNTAX
[no] mac-learning
DEFAULT SETTING
Enabled
COMMAND MODE
Interface Configuration (Ethernet or Port Channel)
COMMAND USAGE
â—† The no mac-learning command immediately stops the switch from
learning new MAC addresses on the specified port or trunk. Incoming
traffic with source addresses not stored in the static address table, will
be flooded. However, if a security function such as 802.1X or DHCP
snooping is enabled and mac-learning is disabled, then only incoming
Table 87: Port Security Commands
Command Function Mode
mac-address-table static Maps a static address to a port in a VLAN GC
mac-learning Enables MAC address learning on the selected physical
interface or VLAN
IC
port security Configures a secure port IC
port security
mac-address-as-
permanent
Saves the MAC addresses learned by port security as
static entries.
PE
show mac-address-table Displays entries in the bridge-forwarding database PE
show port security
Displays port security status and secure address count PE
To Next Page
Loading...
Need help?
General
