CLI Guide

Layer 2 Switching Commands 312
switchport port-security mac-address sticky 0011.2233.4455 vlan 33
Statically locked MAC addresses appear in the running-config in the
following form:
switchport port-security mac-address 0011.2233.4455 vlan 33
In order for sticky or static MAC addresses to survive a reboot, the
configuration must be saved.
Dynamic port security may be implemented on a VLAN or interface basis.
Use the switchport port-security dynamic vlan vlan-id maximum val or
switchport port-security dynamic vlan range vlan-range maximum val syntax
to configure VLAN security. Use the switchport port-security dynamic val
syntax to configure port based security.
VLAN port security allows the administrator to secure the network by locking
a station to a particular VLAN. Packets with a matching source MAC address
are forwarded normally in the identified VLAN. All other packets in the
VLAN are dropped.
Port security must be enabled globally to enable VLAN port security. Either or
both may be enabled. Interface port security and VLAN port security may be
configured simultaneously on a port. In the case of conflicts in configuration,
VLAN port security is given precedence.
A maximum of 600 MAC address may be learned on a VLAN with VLAN port
security
enabled.
Command History
Updated in 6.3.0.1 firmware. Additional VLAN security parameters added in
the 6.6.1 firmware release.
Example
Enable port security/MAC locking globally and on an interface.
console(config)#switchport port-security
console(config)#interface gi1/0/3
console(config-if-gi1/0/3)#switchport port-security