47-8
Cisco 7600 Series Router Cisco IOS Software Configuration Guide, Release 12.2SX
OL-4266-08
Chapter 47 Configuring Port Security
Configuring Port Security
Port security examines all traffic received by secure ports to detect violations or to recognize and secure
new MAC addresses. When the shutdown violation mode is configured, traffic cannot enter the secure
port after a violation has been detected, which removes the possibility that violations might cause
excessive CPU load.
When the protect or restrict violation modes are configured, port security continues to process traffic
after a violation occurs, which might cause excessive CPU load. Configure the port security rate limiter
to protect the CPU against excessive load when the protect or restrict violation modes are configured.
To configure the port security rate limiter, perform this task:
When configuring the port security rate limiter, note the following information:
•
For the
rate_in_pps
value:
–
The range is 10 through 1,000,000 (entered as 1000000).
–
There is no default value.
–
The lower the value, the more the CPU is protected. The rate limiter is applied to traffic both
before and after a security violation occurs. Configure a value high enough to permit
nonviolating traffic to reach the port security feature.
–
Values lower than 1,000 (entered as 1000) should offer sufficient protection.
•
For the
burst_size
value:
–
The range is 1 through 255.
–
The default is 10.
–
The default value should provide sufficient protection.
This example shows how to configure the port security rate limiter:
Router#
configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
Router(config)#
mls rate-limit layer2 port-security 1000
Router(config)#
end
This example shows how to verify the configuration:
Router#
show mls rate-limit | include PORTSEC
LAYER_2 PORTSEC On 1000 1 Not sharing
Command
Purpose
Step 1
Router(config)#
mls rate-limit layer2
port-security
rate_in_pps
[
burst_size
]
Configures the port security rate limiter.
Router(config)#
no mls rate-limit layer2
port-security
Reverts to the default configuration.
Step 2
Router(config)#
do show mls rate-limit | include
PORTSEC
Verifies the configuration.
