2-715
Catalyst 3750 Metro Switch Command Reference
OL-9645-10
Chapter 2 Catalyst 3750 Metro Switch Cisco IOS Commands
switchport port-security
Defaults
The default is to disable port security.
When port security is enabled and no keywords are entered, the default maximum number of secure
MAC addresses is 1.
The default violation mode is
shutdown
.
Sticky learning is disabled.
Command Modes
Interface configuration
Command History
Usage Guidelines
A secure port has the following limitations:
•
A secure port can be an access port or a trunk port; it cannot be a dynamic access port.
•
A secure port cannot be a routed port.
•
A secure port cannot be a protected port.
•
A secure port cannot be a destination port for Switched Port Analyzer (SPAN).
•
A secure port cannot belong to a Fast EtherChannel or a Gigabit EtherChannel port group.
protect
Set the security violation protect mode. In this mode, when the number
of port secure MAC addresses reaches the maximum limit allowed on
the port, packets with unknown source addresses are dropped until you
remove a sufficient number of secure MAC addresses to drop below the
maximum value or increase the number of maximum allowable
addresses. You are not notified that a security violation has occurred.
Note
We do not recommend configuring the protect mode on a trunk
port. The protect mode disables learning when any VLAN
reaches its maximum limit, even if the port has not reached its
maximum limit.
restrict
Set the security violation restrict mode. In this mode, when the number
of secure MAC addresses reaches the limit allowed on the port, packets
with unknown source addresses are dropped until you remove a
sufficient number of secure MAC addresses or increase the number of
maximum allowable addresses. An SNMP trap is sent, a syslog message
is logged, and the violation counter increments.
shutdown
Set the security violation shutdown mode. In this mode, the interface is
error-disabled when a violation occurs and the port LED turns off. An
SNMP trap is sent, a syslog message is logged, and the violation counter
increments. When a secure port is in the error-disabled state, you can
bring it out of this state by entering the
errdisable recovery cause
psecure-violation
global configuration command, or you can manually
re-enable it by entering the
shutdown
and
no shut down
interface
configuration commands.
Release
Modification
12.1(14)AX
This command was introduced.
