Specifications

2-623
Cisco ME 3400 Ethernet Access Switch Command Reference
OL-9640-07
Chapter 2 Cisco ME 3400 Ethernet Access Switch Cisco IOS Commands
switchport port-security
Defaults The default is to disable port security.
When port security is enabled and no keywords are entered, the default maximum number of secure
MAC addresses is 1.
The default violation mode is shutdown.
Sticky learning is disabled.
Command Modes Interface configuration
Command History
Usage Guidelines If the port is a user network interface (UNI) or enhanced network interface (ENI), you must use the no
shutdown interface configuration command to enable it before using the switchport port-security
command. UNIs and ENIs are disabled by default. Network node interfaces (NNIs) are enabled by
default.
violation (Optional) Set the security violation mode or the action to be taken if
port security is violated. The default is shutdown.
protect Set the security violation protect mode. In this mode, when the number
of port secure MAC addresses reaches the maximum limit allowed on
the port, packets with unknown source addresses are dropped until you
remove a sufficient number of secure MAC addresses to drop below the
maximum value or increase the number of maximum allowable
addresses. You are not notified that a security violation has occurred.
Note We do not recommend configuring the protect mode on a trunk
port. The protect mode disables learning when any VLAN
reaches its maximum limit, even if the port has not reached its
maximum limit.
restrict Set the security violation restrict mode. In this mode, when the number
of secure MAC addresses reaches the limit allowed on the port, packets
with unknown source addresses are dropped until you remove a
sufficient number of secure MAC addresses or increase the number of
maximum allowable addresses. An SNMP trap is sent, a syslog message
is logged, and the violation counter increments.
shutdown Set the security violation shutdown mode. In this mode, the interface is
error-disabled when a violation occurs and the port LED turns off. An
SNMP trap is sent, a syslog message is logged, and the violation counter
increments. When a secure port is in the error-disabled state, you can
bring it out of this state by entering the errdisable recovery cause
psecure-violation global configuration command, or you can manually
re-enable it by entering the shutdown and no shut down interface
configuration commands.
Release Modification
12.2(25)EX This command was introduced.