Configuring Security
Configuring Port Security
Cisco 500 Series Stackable Managed Switch Administration Guide
316
18
Configuring Port Security
Network security can be increased by limiting access on a port to users with
specific MAC addresses. The MAC addresses can be either dynamically learned
or statically configured.
Port security monitors received and learned packets. Access to locked ports is
limited to users with specific MAC addresses.
Port Security has two modes:
•
Classic Lock
—All learned MAC addresses on the port are locked, and the
port does not learn any new MAC addresses. The learned addresses are not
subject to aging or re-learning.
•
Limited Dynamic Lock
—The switch learns MAC addresses up to the
configured limit of allowed addresses. After the limit is reached, the switch
does not learn additional addresses. In this mode, the addresses are
subject to aging and re-learning.
When a frame from a new MAC address is detected on a port where it is not
authorized (the port is classically locked, and there is a new MAC address, or the
port is dynamically locked, and the maximum number of allowed addresses has
been exceeded), the protection mechanism is invoked, and one of the following
actions can take place:
•
Frame is discarded
•
Frame is forwarded
•
Port is shut down
When the secure MAC address is seen on another port, the frame is forwarded,
but the MAC address is not learned on that port.
In addition to one of these actions, you can also generate traps, and limit their
frequency and number to avoid overloading the devices.
NOTE
If you want to use 802.1X on a port, it must be in multiple host or multi session
modes. Port security on a port cannot be set if the port is in single mode (see the
802.1x, Host and Session Authentication
page
)
.
