Users Guide

● To drop the packet when a MAC address learning limit violation occurs, use the drop option.
OS10(config-if-port-sec)#mac-learn limit violation drop
● To forward the packet when a MAC address learning limit violation occurs, use the flood option. The system does not learn
the MAC address.
OS10(config-if-port-sec)#mac-learn limit violation forward
● To shut down an interface on a MAC address learning limit violation, use the shutdown option.
OS10(config-if-port-sec)#mac-learn limit violation shutdown
MAC address learning limit violation actions configuration example
OS10# configure terminal
OS10(config)#interface ethernet 1/1/1
OS10(config-if-eth1/1/1)#switchport port-security
OS10(config-if-port-sec)#no disable
OS10(config-if-port-sec)#mac-learn limit 100
OS10(config-if-port-sec)#mac-learn limit violation shutdown
Configure sticky MAC addresses
To enable sticky MAC address learning on an interface:
Enter the following command in INTERFACE PORT SECURITY mode:
sticky
NOTE:
Before enabling sticky MAC address learning, ensure that you restrict the number of MAC address that an interface
can learn using the mac-learn limit command.
Sticky MAC addresses configuration example
OS10# configure terminal
OS10(config)#interface ethernet 1/1/1
OS10(config-if-eth1/1/1)#switchport port-security
OS10(config-if-port-sec)#no disable
OS10(config-if-port-sec)#mac-learn limit 100
OS10(config-if-port-sec)#sticky
Permit MAC address movement
Use the following command in INTERFACE PORT SECURITY mode:
OS10(config-if-port-sec)#mac-move allow
MAC address movement configuration example
OS10# configure terminal
OS10(config)#interface ethernet 1/1/1
OS10(config-if-eth1/1/1)#switchport port-security
OS10(config-if-port-sec)#no disable
OS10(config-if-port-sec)#mac-learn limit 100
OS10(config-if-port-sec)#mac-move allow
Configure MAC address movement violation actions
Use the following commands in INTERFACE PORT SECURITY mode:
● To display which MAC address causes a violation, use the log option. The system also drops the packet.
OS10(config-if-port-sec)#mac-move violation log
● To drop the packet when a MAC address movement violation occurs, use the drop option.
OS10(config-if-port-sec)#mac-move violation drop
Security
1393