Users Guide

1. Enter the following command in INTERFACE mode:
switchport port-security
2. Configure the number of secure MAC addresses that an interface can learn in INTERFACE PORT SECURITY mode:
mac-learn {limit | no-limit}
For the limit keyword, the range is from 1 to 3072. To enable the interface to learn the maximum number of MAC
addresses that the hardware supports, use the no-limit keyword.
MAC address learning limit example
OS10# configure terminal
OS10(config)#interface ethernet 1/1/1
OS10(config-if-eth1/1/1)#switchport port-security
OS10(config-if-port-sec)# no disable
OS10(config-if-port-sec)#mac-learn limit 100
Configure MAC address learning limit violation actions
Use the following commands in INTERFACE PORT SECURITY mode:
● To display which MAC address causes a violation, use the log option. The system also drops the packet.
OS10(config-if-port-sec)#mac-learn limit violation log
● To drop the packet when a MAC address learning limit violation occurs, use the drop option.
OS10(config-if-port-sec)#mac-learn limit violation drop
● To forward the packet when a MAC address learning limit violation occurs, use the flood option. The system does not learn
the MAC address.
OS10(config-if-port-sec)#mac-learn limit violation forward
● To shut down an interface on a MAC address learning limit violation, use the shutdown option.
OS10(config-if-port-sec)#mac-learn limit violation shutdown
MAC address learning limit violation actions configuration example
OS10# configure terminal
OS10(config)#interface ethernet 1/1/1
OS10(config-if-eth1/1/1)#switchport port-security
OS10(config-if-port-sec)#no disable
OS10(config-if-port-sec)#mac-learn limit 100
OS10(config-if-port-sec)#mac-learn limit violation shutdown
Configure sticky MAC addresses
To enable sticky MAC address learning on an interface:
Enter the following command in INTERFACE PORT SECURITY mode:
sticky
NOTE:
Before enabling sticky MAC address learning, ensure that you restrict the number of MAC address that an interface
can learn using the mac-learn limit command.
Sticky MAC addresses configuration example
OS10# configure terminal
OS10(config)#interface ethernet 1/1/1
OS10(config-if-eth1/1/1)#switchport port-security
OS10(config-if-port-sec)#no disable
OS10(config-if-port-sec)#mac-learn limit 100
OS10(config-if-port-sec)#sticky
Security
1383