Cisco 350XG series Administration Manual page 432

Security
Port Security
STEP 1
STEP 2
STEP 3
Cisco 350XG & 550XG Series 10G Stackable Managed Switches
Port Security has four modes:
• Classic Lock—All learned MAC addresses on the port are locked, and the
port does not learn any new MAC addresses. The learned addresses are
not subject to aging or re-learning.
• Limited Dynamic Lock—The device learns MAC addresses up to the
configured limit of allowed addresses. After the limit is reached, the device
does not learn additional addresses. In this mode, the addresses are
subject to aging and re-learning.
• Secure Permanent—Keeps the current dynamic MAC addresses
associated with the port and learns up to the maximum number of
addresses allowed on the port (set by Max No. of Addresses Allowed).
Relearning and aging are disabled.
• Secure Delete on Reset—Deletes the current dynamic MAC addresses
associated with the port after reset. New MAC addresses can be learned
as Delete-On-Reset ones up to the maximum addresses allowed on the
port. Relearning and aging are disabled.
When a frame from a new MAC address is detected on a port where it is not
authorized (the port is classically locked, and there is a new MAC address, or the
port is dynamically locked, and the maximum number of allowed addresses has
been exceeded), the protection mechanism is invoked, and one of the following
actions can take place:
• Frame is discarded
• Frame is forwarded
• Port is shut down
When the secure MAC address is seen on another port, the frame is forwarded,
but the MAC address is not learned on that port.
In addition to one of these actions, you can also generate traps, and limit their
frequency and number to avoid overloading the devices.
To configure port security:
Click Security > Port Security.
Select an interface to be modified, and click Edit.
Enter the parameters.
• Interface—Select the interface name.
19
418