CLI Guide

Layer 2 Switching Commands 309
Syntax
switchport port-security [dynamic { value | vlan {vlan-id | range vlan-
range } maximum limit } | mac-address {mac-address vlan vlan-id | sticky
[mac-addr vlan vlan-id ] } | maximum {val} | violation {protect |
shutdown} ]
no switchport port-security [dynamic [vlan {vlan-id | range vlan-range} ] |
mac-address { mac-addr vlan vlan-id| sticky} | maximum | violation ]
• mac-address — The static MAC address to be configured on the interface
and VLAN.
• vlan-id — The VLAN identifier on which to configure the MAC address.
• dynamic — Configure the maximum number of dynamic MAC addresses
that be be learned on the interface. Setting the dynamic limit to 0 causes
all received packets with non-static MAC addresses to be considered as
violations.
• sticky – Configure a sticky MAC address on the interface. If the sticky
parameter not given, a statically locked MAC address is configured on the
interface.
• maximum < limit > — Configure the maximum number of static MAC
addresses that may be learned on the interface or VLAN.
• violation—Configure the interface to:
– protect—Protect the interface or VLAN by discarding MAC frames
that are not learned (default) and issuing a log message and a trap.
– shutdown—Protect the interface or VLAN by error disabling the
interface and issuing a log message and a trap. If the MAC address
limit is exceeded for a VLAN, the ports participating in the VLAN are
shut down.
Default Configuration
By default, port security is not enabled and VLAN port security is not
enabled. The default behavior is to drop unknown packets when the limit is
exceeded.
There is no default action. Notifications are not sent by default.
No static or sticky MAC addresses are learned or configured by default.