Chapter 9
| General Security Measures
Port Security
– 253 –
Command Mode
Interface Configuration (Ethernet)
Command Usage
◆
The default maximum number of MAC addresses allowed on a secure port
is zero (that is, port security is disabled). To use port security, you must
configure the maximum number of addresses allowed on a port using the
port security max-mac-count
command.
◆
When port security is enabled using the
port security
command, or the
maximum number or allowed addresses is set to a value lower than the
current limit after port security has been enabled, the switch first clears all
dynamically learned entries from the address table. It then starts learning
new MAC addresses on the specified port, and stops learning addresses
when it reaches a configured maximum number. Only incoming traffic with
source addresses already stored in the dynamic or static address table will
be accepted.
◆
To configure the maximum number of address entries which can be
learned on a port, specify the maximum number of dynamic addresses
allowed. The switch will learn up to the maximum number of allowed
address pairs <source MAC address, VLAN> for frames received on the
port. (The specified maximum address count is effective when port
security is enabled or disabled.) Note that you can manually add additional
secure addresses to a port using the
command.
When the port has reached the maximum number of MAC addresses, the
port will stop learning new addresses. The MAC addresses already in the
address table will be retained and will not be aged out.
◆
If port security is enabled, and the maximum number of allowed addresses
are set to a non-zero value, any device not in the address table that
attempts to use the port will be prevented from accessing the switch.
◆
If a port is disabled due to a security violation, it must be manually re-
enabled using the
no
◆
A secure port has the following restrictions:
■
Cannot be connected to a network interconnection device.
■
Cannot be a trunk port.
■
RSPAN and port security are mutually exclusive functions. If port security is
enabled on a port, that port cannot be set as an RSPAN uplink port. Also,
when a port is configured as an RSPAN uplink port, source port, or
destination port, port security cannot be enabled on that port.
