Users Guide

● To shut down the original interface that learned the MAC address on a MAC movement violation, use the shutdown-
original option.
OS10(config-if-port-sec)#mac-move violation shutdown-original
● To shut down the interface that detected a MAC address that is already learned by another interface, use the shutdown-
offending option.
OS10(config-if-port-sec)#mac-move violation shutdown-offending
● To shut down both original and offending interfaces, use the shutdown-both option.
OS10(config-if-port-sec)#mac-move violation shutdown-both
Recover an error-disabled interface
1. Shut down the interface in INTERFACE mode.
shutdown
2. Bring the interface up in INTERFACE mode.
no shutdown
Clear an error-disabled state of all interfaces
● To clear the error-disabled state of all interfaces that was caused by a MAC address learning limit violation, use the following
command in CONFIGURATION mode:
errdisable reset cause mac-learn-limit violation
● To clear the error-disabled state of all interfaces that was caused by a MAC address movement violation, use the following
command in CONFIGURATION mode:
errdisable reset cause mac-move-violation
● To clear the error-disabled state of all interfaces that was caused by all violation incidents, use the following command in
CONFIGURATION mode:
errdisable reset cause all
Recover an error-disabled state of interfaces automatically
● To automatically recover error-disabled interfaces that was caused by a MAC address learning limit violation, use the
following command in CONFIGURATION mode:
errdisable recovery cause mac-learn-limit violation
● To automatically recover error-disabled interfaces that was caused by a MAC address movement violation, use the following
command in CONFIGURATION mode:
errdisable recovery cause mac-move-violation
● Configure the recovery interval timer to delay the recovery of an error-disabled interface in CONFIGURATION mode. The
range is from 30 to 65,535 in seconds.
errdisable recovery interval 30
Configure secure static MAC addresses
● To configure a secure static MAC address, use the following command in CONFIGURATION mode:
mac address-table static mac-address vlan vlan-id interface {ethernet node/slot/
port[:subport] | port-channel number}
NOTE:
The configured MAC address becomes secure MAC address only if you enable the port security feature on the
interface.
1394 Security