Information About Port Blocking; Port Blocking; How To Configure Port Blocking; Blocking Flooded Traffic On An Interface - Cisco Catalyst 2960-X Security Configuration Manual

Information About Port Blocking

Information About Port Blocking

Port Blocking

By default, the switch floods packets with unknown destination MAC addresses out of all ports. If unknown
unicast and multicast traffic is forwarded to a protected port, there could be security issues. To prevent unknown
unicast or multicast traffic from being forwarded from one port to another, you can block a port (protected or
nonprotected) from flooding unknown unicast or multicast packets to other ports.
Note With multicast traffic, the port blocking feature blocks only pure Layer 2 packets. Multicast packets that
contain IPv4 or IPv6 information in the header are not blocked.

How to Configure Port Blocking

Blocking Flooded Traffic on an Interface

Before You Begin
The interface can be a physical interface or an EtherChannel group. When you block multicast or unicast
traffic for a port channel, it is blocked on all ports in the port-channel group.
SUMMARY STEPS
1. enable
2. configure terminal
3. interface interface-id
4. switchport block multicast
5. switchport block unicast
6. end
7. show interfaces interface-id switchport
8. show running-config
9. copy running-config startup-config
Catalyst 2960-X Switch Security Configuration Guide, Cisco IOS Release 15.0(2)EX
402
Configuring Port-Based Traffic Control
OL-29048-01