Users Guide

To enable sticky MAC address learning on an interface, ensure that the mac learn no-limit command is not configured.
Port security violations
There are two types of port security violations.
● Mac address learning limit violation
● Mac address move violation
Mac address learning limit violation
After the number of secure MAC address reaches the maximum configured, if an interface receives a frame with the source
MAC address different from any of the learned MAC addresses, the system considers this as a MAC address learning limit
violation.
You can configure MAC address learning limit violation actions.
● log — The system drops the packet and displays a log message with the VLAN, interface, and the source MAC address
that caused the violation.
● drop — The system drops the packet and does not display a log message.
● forward — The system forwards the packet without learning the source MAC address or displaying a log message.
● shutdown — The system shuts down the port.
Mac address move violation
If the system detects the same MAC address in a port-security-enabled interface which it has already learned through another
port-security-enabled interface, by default, the system considers this as a MAC address move violation. You can configure
MAC address move violation actions. You can also configure the system to permit MAC address movement across port
security-enabled interfaces.
You can configure MAC address move violation actions.
● log — The system drops the packet and displays a log message with the VLAN, interface, and the source MAC address
that caused the violation.
● drop — The system drops the packet and does not display a log message.
● shutdown-both — The system shuts down both the original and offending interfaces.
● shutdown-offending — The system shuts down the offending interface.
● shutdown-original — The system shuts down the interface that originally learned the MAC address that moved.
MAC address aging
By default, dynamically-learned secure MAC addresses do not age out. You can enable aging for secure MAC addresses so that
the dynamically-learned MAC addresses are deleted from the MAC address table after the configured aging period.
Enable port security on the system
To enable port security on the system globally:
1. Enter the following command in CONFIGURATION mode:
switchport port-security
NOTE:
By default, port security is enabled globally. To disable the port security feature on the system, use the no
switchport port-security command in CONFIGURATION mode.
Enable port security on an interface
To enable port security on an interface:
1. Enter the following command in INTERFACE mode:
switchport port-security
2. Enable port security in CONFIGURATION-PORT-SECURITY mode:
no disable
NOTE:
To disable the port security feature on an interface, use the disable command in CONFIGURATION-PORT-
SECURITY mode.
Configure the MAC address learning limit
Security
1187