ECS3510-26P_Management Guide R02

C HAPTER 24 | General Security Measures
Port Security
– 665 –
COMMAND MODE
Interface Configuration (Ethernet)
COMMAND USAGE
◆ The default maximum number of MAC addresses allowed on a secure
port is zero (that is, port security is disabled). To use port security, you
must configure the maximum number of addresses allowed on a port
using the port security max-mac-count command.
◆ When port security is enabled using the port security command, or
the maximum number or allowed addresses is set to value lower than
the limit after port security has been enabled, the switch first clears all
dynamically learned entries from the address table. It then starts
learning new MAC addresses on the specified port, and stops learning
addresses when it reaches a configured maximum number. Only
incoming traffic with source addresses already stored in the dynamic or
static address table will be accepted.
◆ To configure the maximum number of address entries which can be
learned on a port, first disable port security on a port using the no port
security command, and then specify the maximum number of dynamic
addresses allowed. The switch will learn up to the maximum number of
allowed address pairs <source MAC address, VLAN> for frames
received on the port. (The specified maximum address count is
effective when port security is enabled or disabled.) Note that you can
manually add additional secure addresses to a port using the mac-
address-table static command. When the port has reached the
maximum number of MAC addresses, the port will stop learning new
addresses. The MAC addresses already in the address table will be
retained and will not be aged out.
◆ If port security is enabled, and the maximum number of allowed
addresses are set to a non-zero value, any device not in the address
table that attempts to use the port will be prevented from accessing the
switch.
◆ If a port is disabled due to a security violation, it must be manually re-
enabled using the no shutdown command.
◆ A secure port has the following restrictions:
■
Cannot be connected to a network interconnection device.
■
Cannot be a trunk port.
EXAMPLE
The following example enables port security for port 5, and sets the
response to a security violation to issue a trap message:
Console(config)#interface ethernet 1/5
Console(config-if)#port security action trap