Specifications

9-18
System Management Software Configuration Guide for Cisco IE 2000U and Connected Grid Switches
Chapter 9 Configuring Port-Based Traffic Control
Configuring Port Security
You can verify the previous commands by entering the show port-security interface interface-id
privileged EXEC command.
Port Security and Private VLANs
Port security allows an administrator to limit the number of MAC addresses learned on a port or to define
which MAC addresses can be learned on a port. Follow this procedure to configure port security on a
PVLAN host and promiscuous ports.
BEFORE YOU BEGIN
Review the “Guidelines and Limitations” section on page 9-5.
DETAILED STEPS
EXAMPLE
Switch(config)# interface GigabitEthernet0/8
Switch(config-if)# switchport private-vlan mapping 2061 2201-2206,3101
Switch(config-if)# switchport mode private-vlan promiscuous
Switch(config-if)# switchport port-security maximum 288
Switch(config-if)# switchport port-security
Switch(config-if)# switchport port-security violation restrict
Note Ports that have both port security and private VLANs configured can be labeled secure PVLAN ports.
When a secure address is learned on a secure PVLAN port, the same secure address cannot be learned
on another secure PVLAN port belonging to the same primary VLAN. However, an address learned on
an unsecure PVLAN port can be learned on a secure PVLAN port belonging to same primary VLAN.
Secure addresses that are learned on host port get automatically replicated on associated primary
VLANs, and similarly, secure addresses learned on promiscuous ports automatically get replicated on
all associated secondary VLANs. Static addresses (using the mac-address-table static command)
cannot be user configured on a secure port.
Command Purpose
Step 1
configure terminal Enter global configuration mode.
Step 2
interface interface-id Specify the interface to configure, and enter interface
configuration mode.
Step 3
switchport mode private-vlan {host |
promiscuous}
Enable a private VLAN on the interface.
Step 4
switchport port-security Enable port security on the interface.
Step 5
end Return to privileged EXEC mode.
Step 6
show port-security [interface interface-id]
[address]
Verify your entries.
Step 7
copy running-config startup-config (Optional) Save your entries in the configuration file.