Cisco MDS 9000 Series Configuration Manual page 244

Port Security Enforcement
• Configuring the port security policy requires the ENTERPRISE_PKG license (see the Cisco MDS 9000
This section includes the following topics:
Port Security Enforcement
To enforce port security, configure the devices and switch port interfaces through which each device or switch
is connected, and activate the configuration.
• Use the port world wide name (pWWN) or the node world wide name (nWWN) to specify the Nx port
• Use the switch world wide name (sWWN) to specify the xE port connection for each switch.
Each Nx and xE port can be configured to restrict a single port or a range of ports.
Enforcement of port security policies are done on every activation and when the port tries to come up.
The port security feature uses two databases to accept and implement configuration changes.
• Configuration database—All configuration changes are stored in the configuration database.
• Active database—The database currently enforced by the fabric. The port security feature requires all
About Auto-Learning
You can instruct the switch to automatically learn (auto-learn) the port security configurations over a specified
period. This feature allows any switch in the Cisco MDS 9000 Family to automatically learn about devices
and switches that connect to it. Use this feature when you activate the port security feature for the first time
as it saves tedious manual configuration for each port. You must configure auto-learning on a per-VSAN
basis. If enabled, devices and switches that are allowed to connect to the switch are automatically learned,
even if you have not configured any port access.
When auto-learning is enabled, learning happens for the devices or interfaces that were already logged into
the switch and the new devices or interfaces that need to be logged in. Learned entries on a port are cleaned
up after you shut down that port if auto-learning is still enabled.
Learning does not override the existing configured port security policies. So, for example, if an interface is
configured to allow a specific pWWN, then auto-learning will not add a new entry to allow any other pWWN
on that interface. All other pWWNs will be blocked even in auto-learning mode.
No entries are learned for a port in the shutdown state.
When you activate the port security feature, auto-learning is also automatically enabled.
Note
If you activate port security feature, auto-learning gets enabled by default. You cannot re-activate port security
until auto-learning is disabled or deactivate and activate again.
Cisco MDS 9000 Series Security Configuration Guide, Release 8.x
226
Family NX-OS Licensing Guide).
connection for each device.
devices connecting to a switch to be part of the port security active database. The software uses this
active database to enforce authorization.
Configuring Port Security