47-5
Cisco 7600 Series Router Cisco IOS Software Configuration Guide, Release 12.2SX
OL-4266-08
Chapter 47 Configuring Port Security
Configuring Port Security
Enabling Port Security
These sections describe how to enable port security:
•
Enabling Port Security on a Trunk, page 47-5
•
Enabling Port Security on an Access Port, page 47-6
Enabling Port Security on a Trunk
With Release 12.2(18)SXE and later releases, port security supports nonnegotiating trunks.
Caution
Because the default number of secure addresses is one and the default violation action is to shut down
the port, configure the maximum number of secure MAC addresses on the port before you enable port
security on a trunk (see
“Configuring the Maximum Number of Secure MAC Addresses on a Port”
section on page 47-9
).
To enable port security on a trunk, perform this task:
This example shows how to configure Fast Ethernet port 5/36 as a nonnegotiating trunk and enable port
security:
Router#
configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
Router(config)#
interface fastethernet 5/36
Router(config-if)#
switchport
Router(config-if)#
switchport mode trunk
Router(config-if)#
switchport nonegotiate
Router(config-if)#
switchport port-security
Router(config-if)#
do show port-security interface fastethernet 5/36
| include Port Security
Port Security : Enabled
Command
Purpose
Step 1
Router(config)#
interface
type
1
slot/port
1.
type
=
ethernet
,
fastethernet
,
gigabitethernet
, or
tengigabitethernet
Selects the LAN port to configure.
Step 2
Router(config-if)#
switchport
Configures the port as a Layer 2 switchport.
Step 3
Router(config-if)#
switchport trunk encapsulation
{
isl
|
dot1q
}
Configures the encapsulation, which configures the Layer
2 switching port as either an ISL or 802.1Q trunk.
Step 4
Router(config-if)#
switchport mode trunk
Configures the port to trunk unconditionally.
Step 5
Router(config-if)#
switchport nonegotiate
Configures the trunk not to use DTP.
Step 6
Router(config-if)#
switchport port-security
Enables port security on the trunk.
Router(config-if)#
no switchport port-security
Disables port security on the trunk.
Step 7
Router(config-if)#
do show port-security
interface
type
1
slot/port
| include Port Security
Verifies the configuration.
