Cisco Catalyst 2960-X Security Configuration Manual page 438

Enabling and Configuring Port Security
Command or Action
Example:
Switch(config-if)# switchport
port-security mac-address
00:A0:C7:12:C9:25 vlan 3 voice
Step 10
switchport port-security mac-address
sticky
Example:
Switch(config-if)# switchport
port-security mac-address sticky
Step 11 switchport port-security mac-address
sticky [mac-address | vlan {vlan-id |
{access | voice}}]
Example:
Switch(config-if)# switchport
port-security mac-address sticky
00:A0:C7:12:C9:25 vlan voice
Catalyst 2960-X Switch Security Configuration Guide, Cisco IOS Release 15.0(2)EX
414
Purpose
configure fewer secure MAC addresses than the maximum, the remaining MAC
addresses are dynamically learned.
If you enable sticky learning after you enter this command, the secure
Note
addresses that were dynamically learned are converted to sticky secure
MAC addresses and are added to the running configuration.
(Optional) vlan—sets a per-VLAN maximum value.
Enter one of these options after you enter the vlan keyword:
• vlan-id—On a trunk port, you can specify the VLAN ID and the MAC
address. If you do not specify a VLAN ID, the native VLAN is used.
• access—On an access port, specifies the VLAN as an access VLAN.
• voice—On an access port, specifies the VLAN as a voice VLAN.
The voice keyword is available only if a voice VLAN is configured on
Note
a port and if that port is not the access VLAN. If an interface is configured
for voice VLAN, configure a maximum of two secure MAC addresses.
(Optional) Enables sticky learning on the interface.
(Optional) Enters a sticky secure MAC address, repeating the command as many
times as necessary. If you configure fewer secure MAC addresses than the
maximum, the remaining MAC addresses are dynamically learned, are converted
to sticky secure MAC addresses, and are added to the running configuration.
If you do not enable sticky learning before this command is entered, an
Note
error message appears, and you cannot enter a sticky secure MAC
address.
(Optional) vlan—sets a per-VLAN maximum value.
Enter one of these options after you enter the vlan keyword:
• vlan-id—On a trunk port, you can specify the VLAN ID and the MAC
address. If you do not specify a VLAN ID, the native VLAN is used.
• access—On an access port, specifies the VLAN as an access VLAN.
• voice—On an access port, specifies the VLAN as a voice VLAN.
The voice keyword is available only if a voice VLAN is configured on
Note
a port and if that port is not the access VLAN.
Configuring Port-Based Traffic Control
OL-29048-01