22-16
Catalyst 2928 Switch Software Configuration Guide
OL-23389-01
Chapter 22 Configuring Port-Based Traffic Control
Configuring Port Security
To return the interface to the default condition as not a secure port, use the
no switchport port-security
interface configuration command. If you enter this command when sticky learning is enabled, the sticky
secure addresses remain part of the running configuration but are removed from the address table. All
addresses are now dynamically learned.
To return the interface to the default number of secure MAC addresses, use the
no
switchport
port-security maximum
value
interface configuration command. To return the violation mode to the
default condition (shutdown mode), use the
no
switchport port-security violation
{
protocol
|
restrict
}
interface configuration command.
To disable sticky learning on an interface, use the
no switchport port-security mac-address sticky
interface configuration command. The interface converts the sticky secure MAC addresses to dynamic
secure addresses. However, if you have previously saved the configuration with the sticky MAC
addresses, you should save the configuration again after entering the
no switchport port-security
mac-address sticky
command, or the sticky addresses will be restored if the switch reboots.
Use the
clear port-security
{
all
|
configured | dynamic | sticky
} privileged EXEC command to delete
from the MAC address table all secure addresses or all secure addresses of a specific type (configured,
dynamic, or sticky) on the switch or on an interface.
To delete a specific secure MAC address from the address table, use the
no switchport port-security
mac-address
mac-address
interface configuration command. To delete all dynamic secure addresses on
an interface from the address table, enter the
no switchport port-security
interface configuration
command followed by the
switchport port-security
command (to re-enable port security on the
interface). If you use the
no switchport port-security mac-address sticky
interface configuration
command to convert sticky secure MAC addresses to dynamic secure MAC addresses before entering
the
no switchport port-security
command, all secure addresses on the interface except those that were
manually configured are deleted.
You must specifically delete configured secure MAC addresses from the address table by using the
no
switchport port-security mac-address
mac-address
interface configuration command.
This example shows how to enable port security on a port and to set the maximum number of secure
addresses to 50. The violation mode is the default, no static secure MAC addresses are configured, and
sticky learning is enabled.
Switch(config)#
interface gigabitethernet0/1
Switch(config-if)#
switchport mode access
Switch(config-if)#
switchport port-security
Switch(config-if)#
switchport port-security maximum 50
Switch(config-if)#
switchport port-security mac-address sticky
This example shows how to configure a static secure MAC address on VLAN 3 on a port:
Switch(config)#
interface gigabitethernet0/2
Switch(config-if)#
switchport mode trunk
Switch(config-if)#
switchport port-security
Switch(config-if)#
switchport port-security mac-address 0000.02000.0004 vlan 3
This example shows how to enable sticky port security on a port, to manually configure MAC addresses
for data VLAN and voice VLAN, and to set the total maximum number of secure addresses to 20 (10 for
data VLAN and 10 for voice VLAN).
Switch(config)#
interface FastEthernet0/1
Switch(config-if)#
switchport access vlan 21
Switch(config-if)#
switchport mode access
Switch(config-if)#
switchport voice vlan 22
Switch(config-if)#
switchport port-security
Switch(config-if)#
switchport port-security maximum 20
Switch(config-if)#
switchport port-security violation restrict
Switch(config-if)#
switchport port-security mac-address sticky
Switch(config-if)#
switchport port-security mac-address sticky 0000.0000.0002
