38-5
Catalyst 6500 Series Switch Software Configuration Guide—Release 8.7
OL-8978-04
Chapter 38 Configuring Port Security
Configuring Port Security on the Switch
This example shows how to enable port security using the learned MAC address on a port and verify the
configuration:
Console> (enable)
set port security 2/1 enable
Port 2/1 security enabled.
Console> (enable)
show port 2/1
Port Name Status Vlan Level Duplex Speed Type
----- ------------------ ---------- ---------- ------ ------ ----- ------------
2/1 connected 522 normal half 100 100BaseTX
Port Security Secure-Src-Addr Last-Src-Addr Shutdown Trap IfIndex
----- -------- ----------------- ----------------- -------- -------- -------
2/1 enabled 00-90-2b-03-34-08 00-90-2b-03-34-08 No disabled 1081
Port Broadcast-Limit Broadcast-Drop
-------- --------------- --------------
2/1 - 0
Port Align-Err FCS-Err Xmit-Err Rcv-Err UnderSize
----- ---------- ---------- ---------- ---------- ---------
2/1 0 0 0 0 0
Port Single-Col Multi-Coll Late-Coll Excess-Col Carri-Sen Runts Giants
----- ---------- ---------- ---------- ---------- --------- --------- ---------
2/1 0 0 0 0 0 0 0
Last-Time-Cleared
--------------------------
Fri Jul 10 1998, 17:53:38
This example shows how to enable port security on a port and manually specify the secure MAC address:
Console> (enable)
set port security 2/1 enable 00-90-2b-03-34-08
Port 2/1 port security enabled with 00-90-2b-03-34-08 as the secure mac address
Trunking disabled for Port 2/1 due to Security Mode
Console> (enable)
This example shows how to set port security on a trunk port:
Console> (enable)
set port security 2/2 00-90-2b-03-34-09 1,20,30
Mac address 00-90-2b-03-34-09 set for port 2/2 on vlan 1,20,20
Console> (enable)
Setting the Maximum Number of Secure MAC Addresses
You can set the number of MAC addresses to secure on a port. By default, at least one MAC address per
port can be secured. In addition to this default, a global resource is available to be shared by the ports as
follows:
•
In software releases prior to 8.1(1), you can configure up to 1024 MAC addresses on a port. The
total number of MAC addresses on any port cannot exceed 1025.
•
In software release 8.1(1) and later releases, you can configure up to 4096 MAC addresses on a port.
The total number of MAC addresses on any port cannot exceed 4097.
If the entire global resource of MAC addresses is used on some ports, you can still enable port security
on the rest of the ports with a maximum of one MAC per port.
If you reduce the maximum number of MAC addresses, the system clears the specified number of MAC
addresses and displays the list of removed addresses.
