Port Security And Private Vlans - Cisco IE-4000 Software Configuration Manual

Configuring Port-Based Traffic Control
Information About Port-Based Traffic Control

Inactivity—The secure addresses on the port are deleted only if the secure addresses are inactive for the specified
aging time.
Use this feature to remove and add devices on a secure port without manually deleting the existing secure MAC
addresses and to still limit the number of secure addresses on a port. You can enable or disable the aging of secure
addresses on a per-port basis.

Port Security and Private VLANs

Ports that have both port security and private VLANs (PVLANs) configured can be labeled secure PVLAN ports. When a
secure address is learned on a secure PVLAN port, the same secure address cannot be learned on another secure
PVLAN port belonging to the same primary VLAN. However, an address learned on unsecure PVLAN port can be learned
on a secure PVLAN port belonging to same primary VLAN.
Secure addresses that are learned on host port get automatically replicated on associated primary VLANs, and similarly,
secure addresses learned on promiscuous ports automatically get replicated on all associated secondary VLANs. Static
addresses (using the mac-address-table static command) cannot be user configured on a secure port.
Protocol Storm Protection
When a switch is flooded with Address Resolution Protocol (ARP) or control packets, high CPU utilization can cause the
CPU to overload. These issues can occur:

Routing protocol can flap because the protocol control packets are not received, and neighboring adjacencies are
dropped.

Spanning Tree Protocol (STP) reconverges because the STP bridge protocol data unit (BPDU) cannot be sent or
received.

CLI is slow or unresponsive.
Using protocol storm protection, you can control the rate at which control packets are sent to the switch by specifying
the upper threshold for the packet flow rate. The supported protocols are ARP, ARP snooping, Dynamic Host
Configuration Protocol (DHCP) v4, DHCP snooping, Internet Group Management Protocol (IGMP), and IGMP snooping.
When the packet rate exceeds the defined threshold, the switch drops all traffic arriving on the specified virtual port for
30 seconds. The packet rate is measured again, and protocol storm protection is again applied if necessary.
For further protection, you can manually error disable the virtual port, blocking all incoming traffic on the virtual port. You
can manually enable the virtual port or set a time interval for automatic reenabling of the virtual port.
Note: Excess packets are dropped on no more than two virtual ports.
Virtual port error disabling is not supported for EtherChannel and Flex Link interfaces.
Protocol storm protection is disabled by default. When it is enabled, auto-recovery of the virtual port is disabled by
default.
453