197
7.4.
Port Security
The Switch will learn the MAC address of the device directly connected to a particular port
and allow traffic through. Ask the question: “How do we control who and how many can
connect to a switch port?” This is where port security can assist us. The Switch allow us to
control which devices can connect to a switch port or how many of them can connect to it
(such as when a hub or another switch is connected to the port).
Let’s say we have only one switch port left free and we need to connect five hosts to it.
What can we do? Connect a hub or switch to the free port! Connecting a switch or a hub to
a port has implications. It means that the network will have more traffic. If a switch or a
hub is connected by a user instead of an administrator, then there are chances that loops
will be created. So, it is best that number of hosts allowed to connect is restricted at the
switch level. This can be done using the “port-security limit” command. This command
configures the maximum number of MAC addresses that can source traffic through a port.
Port security can sets maximum number of MAC addresses allowed per interface. When
the limit is exceeded, incoming packets with new MAC addresses are dropped. It can be
use MAC table to check it. The static MAC addresses are included for the limit.
Note
: If you configure a port of the Switch from disabled to enabled, all of the MAC learned
by this port will be clear.
7.4.1.
CLI Configurations
Node
Command
Description
enable
show port-security
This command displays the current port security
configurations.
enable
configure terminal
This command changes the node to configure
node.
configure port-security
(disable|enable)
This command enables / disables the global port
security function.
configure interface IFNAME
This command enters the interface configure node.
interface
port-security
(disable|enable)
This command enables / disables the port security
function on the specific port.
interface
port-security limit
<1-1000>
This command configures the maximum MAC
entries on the specific port.
configure interface range
gigabitethernet1/0/
PORTLISTS
This command enters the if-range configure node.
if-range
port-security
(disable|enable)
This command enables / disables the port security
function for the specified ports.
if-range
port-security limit
<1-1000>
This command configures the maximum MAC
entries for the specified ports.