22-7
Catalyst 2928 Switch Software Configuration Guide
OL-23389-01
Chapter 22 Configuring Port-Based Traffic Control
Configuring Port Blocking
Configuring a Protected Port
Beginning in privileged EXEC mode, follow these steps to define a port as a protected port:
To disable protected port, use the
no switchport protected
interface configuration command.
This example shows how to configure a port as a protected port:
Switch#
configure terminal
Switch(config)#
interface gigabitethernet0/1
Switch(config-if)#
switchport protected
Switch(config-if)#
end
Configuring Port Blocking
By default, the switch floods packets with unknown destination MAC addresses out of all ports. If
unknown unicast and multicast traffic is forwarded to a protected port, there could be security issues. To
prevent unknown unicast or multicast traffic from being forwarded from one port to another, you can
block a port (protected or nonprotected) from flooding unknown unicast or multicast packets to other
ports.
These sections contain this configuration information:
•
Default Port Blocking Configuration, page 22-7
•
Blocking Flooded Traffic on an Interface, page 22-7
Default Port Blocking Configuration
The default is to not block flooding of unknown multicast and unicast traffic out of a port, but to flood
these packets to all ports.
Blocking Flooded Traffic on an Interface
Note
The interface can be a physical interface or an EtherChannel group. When you block multicast or unicast
traffic for a port channel, it is blocked on all ports in the port-channel group.
Command
Purpose
Step 1
configure terminal
Enter global configuration mode.
Step 2
interface
interface-id
Specify the interface to be configured, and enter interface
configuration mode.
Step 3
switchport protected
Configure the interface to be a protected port.
Step 4
end
Return to privileged EXEC mode.
Step 5
show interfaces
interface-id
switchport
Verify your entries.
Step 6
copy running-config startup-config
(Optional) Save your entries in the configuration file.
