Port Security - Cisco Catalyst 2000 Configuration Handbook

Switch(config-if)# interface fastethernet 5/10
Switch(config-if)# switchport protocol ip auto
Switch(config-if)# switchport protocol ipx auto
Switch(config-if)# switchport protocol group off
Switch(config-if)# end
Switch(config)# copy running-config startup-config

11-3: Port Security

Port security enables you to configure a port to only allow a given device or devices
■
access to the switch port.
■ Port security defines the allowed devices by MAC address.
MAC addresses for allowed devices can be manually configured and "learned" by
■
the switch.
■ There are limits to how many MAC addresses can be secured on a port. These num-
bers vary between platforms.
When an unauthorized MAC attempts to access the port, the switch can suspend or
■
disable the port.
Port security cannot be configured on a trunk port, a Switched Port Analyzer
■
(SPAN) port, or a port that is dynamically assigned to a VLAN.
■ Port security is supported on the 6500, 4500, 3750, 3560, and 2960 series switches.
Configuration
When a port is active on a switch, any user can plug into the port and access the net-
work. Because many networks use Dynamic Host Configuration Protocol (DCHP) to
assign user addresses, it would be easy for someone with physical access to a network
port to plug his own device, such as a laptop, into the port and become a user on the net-
work. From there, a person could proceed to generate traffic or cause other problems
within the network. Port security enables you to specify the MAC addresses of the
devices that are allowed to connect to the port. Use the following steps to configure port
security.
Enable port security:
1.
(interface) switchport port-security
By default anyone can plug into a port and access network services. To protect a
port, you must first enable port security on the individual port. Use the command
that is appropriate for your device.
Specify the number of MAC addresses:
2.
(interface) switchport port-security maximum number_of_addresses vlan
{vlan_ID | vlan_range}
Chapter 11: Controlling Traffic and Switch Access 173