Users Guide

668 Port and System Security
Configuring Port Security (CLI)
Use the following commands to enable port security on an interface to limit
the number of source MAC addresses that can be learned.
Command Purpose
configure Enter Global Configuration mode.
switchport port-security Enable port-security administrative mode. Port security
must be enabled globally in order to operate on any
interfaces.
interface interface Enter interface configuration mode for the specified
interface. The interface variable includes the interface type
and number, for example tengigabitethernet 1/0/3.
A range of interfaces can be specified using the interface
range command. For example, interface range
tengigabitethernet 1/0/8-12 configures interfaces 8, 9, 10,
11, and 12.
switchport port-security
[mac-address {sticky |
[sticky] mac-address
vlan {vlan-id}}] |
dynamic value |
maximum value] |
violation {protect |
shutdown}]
Enable port security on the port. This prevents the switch
from learning new addresses on this port after the
maximum number of addresses has been learned.
• mac-address — Configure a static MAC address on the
interface and VLAN. This command performs the same
function as the mac address-table static command. Use
the optional sticky keyword to configure a sticky MAC
address.
• dynamic — Set the maximum number of dynamic MAC
addresses that may be learned on the interface.
• maximum — Set the maximum number of static MAC
addresses that may be configured on the interface. This
limit applies regardless of the port security administrative
setting.
• sticky — Convert dynamic addresses learned on the
interface to sticky
• violation — Configure the interface behavior on a port
security violation
CTRL + Z Exit to Privileged Exec mode.