Switchport Port-Security - Cisco Catalyst 3550 Command Reference Manual

Chapter 2 Cisco IOS Commands

switchport port-security

Use the switchport port-security interface configuration command without keywords to enable port
security on an interface or trunk port. Use the keywords to configure secure MAC addresses, a maximum
number of secure MAC addresses on an interface or VLAN, or the violation mode. Use the no form of
this command to disable port security or to set the parameters to their default states.
Syntax Description mac-address mac-address
[vlan vlan id]
mac-address sticky
[mac-address [vlan vlan-id]]
maximum value [vlan
vlan-list]
violation
78-11195-09
switchport port-security [mac-address {mac-address [vlan vlan-id] | sticky [mac-address [vlan
vlan-id]]}] | [maximum value [vlan vlan-list]] | [violation {protect | restrict | shutdown}]
no switchport port-security [mac-address {mac-address [vlan vlan-id] | sticky [mac-address
[vlan vlan-id]]}] | [maximum [vlan]] | [violation {protect | restrict | shutdown}]
(Optional) Specify a secure MAC address for the interface by entering
a 48-bit MAC address. You can add additional secure MAC addresses
up to the maximum value configured. On a trunk port, you can specify
the VLAN ID along with the MAC address. If no VLAN ID is specified,
the native VLAN is used.
(Optional) Enable the interface for sticky learning by entering only the
mac-address sticky keywords. When sticky learning is enabled, the
interface adds all secure MAC addresses that are dynamically learned to
the running configuration and converts these addresses to sticky secure
MAC addresses.
Specify a sticky secure MAC address by entering the mac-address
sticky mac-address keywords. On a trunk port, you can specify the
VLAN ID along with the MAC address. If no VLAN ID is specified, the
native VLAN is used.
Although you can specify a sticky secure MAC address by
Note
entering the mac-address sticky mac-address keywords, we
recommend using the mac-address mac-address interface
configuration command to enter static secure MAC addresses.
(Optional) Set the maximum number of secure MAC addresses for the
interface. The maximum number of available addresses is determined
by the active Switch Database Management (SDM) template. The
default is 1.
(Optional) For trunk ports, you can set the maximum number of secure
MAC addresses on a VLAN:
• vlan—set a per-VLAN maximum value.
• vlan vlan list—set a per-VLAN maximum value on a range of
VLANs separated by a hyphen or a series of VLANs separated by
a comma. For nonspecified VLANs, the per-VLAN maximum value
is used. If no per-VLAN maximum value is entered, the default
value is used.
(Optional) Set the security violation mode or the action to be taken if
port security is violated. The default is shutdown.
Catalyst 3550 Multilayer Switch Command Reference
switchport port-security
2-467