Cisco ME 3400 Command Reference Manual page 649

Chapter 2 Cisco ME 3400 Ethernet Access Switch Cisco IOS Commands
violation
protect
restrict
shutdown
Defaults The default is to disable port security.
When port security is enabled and no keywords are entered, the default maximum number of secure
MAC addresses is 1.
The default violation mode is shutdown.
Sticky learning is disabled.
Command Modes
Interface configuration
Command History Release
12.2(25)EX
Usage Guidelines
If the port is a user network interface (UNI) or enhanced network interface (ENI), you must use the no
shutdown interface configuration command to enable it before using the switchport port-security
command. UNIs and ENIs are disabled by default. Network node interfaces (NNIs) are enabled by
default.
OL-9640-07
(Optional) Set the security violation mode or the action to be taken if
port security is violated. The default is shutdown.
Set the security violation protect mode. In this mode, when the number
of port secure MAC addresses reaches the maximum limit allowed on
the port, packets with unknown source addresses are dropped until you
remove a sufficient number of secure MAC addresses to drop below the
maximum value or increase the number of maximum allowable
addresses. You are not notified that a security violation has occurred.
We do not recommend configuring the protect mode on a trunk
Note
port. The protect mode disables learning when any VLAN
reaches its maximum limit, even if the port has not reached its
maximum limit.
Set the security violation restrict mode. In this mode, when the number
of secure MAC addresses reaches the limit allowed on the port, packets
with unknown source addresses are dropped until you remove a
sufficient number of secure MAC addresses or increase the number of
maximum allowable addresses. An SNMP trap is sent, a syslog message
is logged, and the violation counter increments.
Set the security violation shutdown mode. In this mode, the interface is
error-disabled when a violation occurs and the port LED turns off. An
SNMP trap is sent, a syslog message is logged, and the violation counter
increments. When a secure port is in the error-disabled state, you can
bring it out of this state by entering the errdisable recovery cause
psecure-violation global configuration command, or you can manually
re-enable it by entering the shutdown and no shut down interface
configuration commands.
Modification
This command was introduced.
Cisco ME 3400 Ethernet Access Switch Command Reference
switchport port-security
2-623