CLI Reference Guide-R04

Chapter 9 | General Security Measures
Port Security
– 299 –
Command Usage
◆ The no mac-learning command immediately stops the switch from learning
new MAC addresses on the specified port or trunk. Incoming traffic with source
addresses not stored in the static address table, will be flooded. However, if a
security function such as 802.1X or DHCP snooping is enabled and mac-
learning is disabled, then only incoming traffic with source addresses stored in
the static address table will be accepted, all other packets are dropped. Note
that the dynamic addresses stored in the address table when MAC address
learning is disabled are flushed from the system, and no dynamic addresses are
subsequently learned until MAC address learning has been re-enabled.
◆ The mac-learning commands cannot be used if 802.1X Port Authentication has
been globally enabled on the switch with the dot1x system-auth-control
command, or if MAC Address Security has been enabled by the port security
command on the same interface.
Example
The following example disables MAC address learning for port 2.
Console(config)#interface ethernet 1/2
Console(config-if)#no mac-learning
Console(config-if)#
Related Commands
show interfaces status (428)
port security This command enables or configures port security. Use the no form without any
keywords to disable port security. Use the no form with the appropriate keyword to
restore the default settings for a response to security violation or for the maximum
number of allowed addresses.
Syntax
port security [action {shutdown | trap | trap-and-shutdown}
| max-mac-count address-count]
no port security [action | max-mac-count]