CLI Guide

Layer 2 Switching Commands 310
The default number of dynamic MAC addresses per interface is 600 (300 for
the N1500 Series switches). The default number of static MAC addresses per
interface is 100.
Both limits are subject to the total MAC address limit supported by the
system.
Command Mode
Interface (Ethernet and port-channel) Configuration mode.
Interface Range mode - Only when using switchport port-security syntax.
User Guidelines
Port security allows the network administrator to secure interfaces or VLANs
by specifying (or learning) the allowed MAC addresses or a limit on a given
port or VLAN. Packets with a matching source MAC address are forwarded
normally. All other host packets are discarded. Port security operates on
access, trunk and general mode ports.
Two methods are used to implement port security: dynamic locking and static
locking. Static locking supports an optional sticky mode.
Dynamic locking implements a ‘first arrival’ mechanism for MAC locking.
The administrator specifies how many dynamic addresses may be learned on
the secure port. If the limit has not been reached, then a packet with an
unknown source MAC address is learned and forwarded normally. If the MAC
address limit has been reached, the packet is discarded, the MAC address is
not learned, and a violation is raised. The administrator can disable dynamic
learning by setting the number of allowable dynamic entries to zero. This
causes all packets with unknown MAC addresses to be considered as
violations.
When a port security enabled link goes down, all of the dynamically learned
addresses are removed from the MAC forwarding database. When the link is
restored, that port can once again learn MAC addresses up to the
administrator specified limit.
A dynamically learned MAC address is eligible to be aged out if another
packet with that MAC address is not seen within the age-out time.
Dynamically learned MAC addresses are also eligible to be re-learned on
another port if station movement occurs.