Specifications

9-14
System Management Software Configuration Guide for Cisco IE 2000U and Connected Grid Switches
Chapter 9 Configuring Port-Based Traffic Control
Configuring Port Security
Step 7
switchport port-security
violation {protect | restrict |
shutdown}
(Optional) Set the violation mode, the action to be taken when a
security violation is detected, as one of these:
• protect—When the number of port secure MAC addresses
reaches the maximum limit allowed on the port, packets with
unknown source addresses are dropped until you remove a
sufficient number of secure MAC addresses to drop below the
maximum value or increase the number of maximum allowable
addresses. You are not notified that a security violation has
occurred.
Note We do not recommend configuring the protect mode on a
trunk port. The protect mode disables learning when any
VLAN reaches its maximum limit, even if the port has not
reached its maximum limit.
• restrict—When the number of secure MAC addresses reaches
the limit allowed on the port, packets with unknown source
addresses are dropped until you remove a sufficient number of
secure MAC addresses or increase the number of maximum
allowable addresses. An SNMP trap is sent, a syslog message is
logged, and the violation counter increments.
• shutdown—(Default) The interface is error-disabled when a
violation occurs, and the port LED turns off. An SNMP trap is
sent, a syslog message is logged, and the violation counter
increments.
Note When a secure port is in the error-disabled state, you can
bring it out of this state by entering the errdisable recovery
cause psecure-violation global configuration command, or
you can manually re-enable it by entering the shutdown and
no shutdown interface configuration commands.
Step 8
switchport port-security
[mac-address mac-address
[vlan {vlan-id | {access}}]
(Optional) Enter a secure MAC address for the interface. You can
use this command to enter the maximum number of secure MAC
addresses. If you configure fewer secure MAC addresses than the
maximum, the remaining MAC addresses are dynamically learned.
Note If you enable sticky learning after you enter this command,
the secure addresses that were dynamically learned are
converted to sticky secure MAC addresses and are added to
the running configuration.
(Optional) vlan—set a per-VLAN maximum value.
Enter one of these options after you enter the vlan keyword:
• vlan-id—On a trunk port, you can specify the VLAN ID and the
MAC address. If you do not specify a VLAN ID, the native
VLAN is used.
• access—On an access port, specify the VLAN as an access
VLAN.
Step 9
switchport port-security
mac-address sticky
(Optional) Enable sticky learning on the interface.
Command Purpose