CLI Reference Guide-R04

Chapter 9 | General Security Measures
Port Security
– 301 –
number of MAC addresses, the port will stop learning new addresses. The MAC
addresses already in the address table will be retained and will not be aged out.
◆ MAC addresses that port security has learned, can be saved in the configuration
file as static entries. See command port security mac-address-as-permanent.
◆ If port security is enabled, and the maximum number of allowed addresses are
set to a non-zero value, any device not in the address table that attempts to use
the port will be prevented from accessing the switch.
◆ If a port is disabled due to a security violation, it must be manually re-enabled
using the no shutdown command.
◆ A secure port has the following restrictions:
■
Cannot be connected to a network interconnection device.
■
Cannot be a trunk port.
■
RSPAN and port security are mutually exclusive functions. If port security is
enabled on a port, that port cannot be set as an RSPAN uplink port. Also,
when a port is configured as an RSPAN uplink port, source port, or
destination port, port security cannot be enabled on that port.
Example
The following example enables port security for port 5, and sets the response to a
security violation to issue a trap message:
Console(config)#interface ethernet 1/5
Console(config-if)#port security action trap
Related Commands
show interfaces status (428)
shutdown (415)
mac-address-table static (502)
port security
mac-address-as-
permanent
Use this command to save the MAC addresses that port security has learned as
static entries.
Syntax
port security mac-address-as-permanent [interface interface]
interface - Specifies a port interface.
ethernet unit/port
unit - Unit identifier. (Range: 1)
port - Port number. (Range: 1-28)