About Port Security - Cisco Catalyst 4500 series Administration Manual

Chapter 49 Configuring Port Security
Command
switchport port-security mac-address
sticky
no switchport port-security
mac-address sticky
switchport port-security maximum
switchport port-security violation
no switchport port-security violation
switchport trunk encapsulation dot1q Sets the encapsulation mode to

About Port Security

Port security enables you to restrict the number of MAC addresses (termed secure MAC addresses) on a
port, allowing you to prevent access by unauthorized MAC addresses. It also allows you to configure a
maximum number of secure MAC addresses on a given port (and optionally for a VLAN for trunk ports).
When a secure port exceeds the maximum, a security violation is triggered, and a violation action is
performed based on the violation action mode configured on the port.
If you configure the maximum number of secure MAC addresses as 1 on the port, the device attached to
the secure port is assured sole access to the port.
If a secure MAC address is secured on a port, that MAC address is not allowed to enter on any other port
off that VLAN. If it does, the packet is dropped unnoticed in the hardware. Other than using the interface
or port counters, you do not receive a log message reflecting this fact. Be aware that this condition does
not trigger a violation. Dropping these packets in the hardware is more efficient and can be done without
putting additional load on the CPU.
Port security has the following characteristics:
•
•
•
This overview contains the following topics:
•
•
•
•
•
OL_28731-01
Purpose
Enables sticky Port Security.
Converts a sticky secure MAC
address to a dynamic MAC secure
address.
Sets the maximum number of secure
MAC addresses for an interface.
Sets the violation mode.
Sets the violation mode.
dot1q.
It allows you to age out secure MAC addresses. Two types of aging are supported: inactivity and
absolute.
It supports a sticky feature whereby the secure MAC addresses on a port are retained through switch
reboots and link flaps.
It can be configured on various types of ports such as access, voice, trunk, EtherChannel, and private
VLAN ports.
Secure MAC Addresses, page 49-4
Maximum Number of Secure MAC Addresses, page 49-4
Aging Secure MAC Addresses, page 49-5
Sticky Addresses on a Port, page 49-5
Violation Actions, page 49-6
Navigation
Sticky Addresses on a Port,
page 49-5
Configuring Port Security on Access
Ports, page 49-7
Example 1: Setting Maximum
Number of Secure Addresses,
page 49-11
Example 2: Setting a Violation
Mode, page 49-11
Configuring Port Security on Access
Ports, page 49-7
Example 1: Configuring a Maximum
Limit of Secure MAC Addresses for
All VLANs, page 49-19
Software Configuration Guide—Release IOS XE 3.6.0E and IOS 15.2(2)E
About Port Security
49-3