Port Security And Private Vlans - Cisco WS-C3020 Software Configuration Manual

Chapter 23 Configuring Port-Based Traffic Control

Port Security and Private VLANs

Port security allows an administrator to limit the number of MAC addresses learned on a port or to define
which MAC addresses can be learned on a port.
Beginning in privileged EXEC mode, follow these steps to configure port security on a PVLAN host and
promiscuous ports:
Command
Step 1
configure terminal
Step 2 interface interface-id
Step 3 switchport mode private-vlan {host |
promiscuous}
Step 4
switchport port-security
Step 5
end
Step 6 show port-security [interface interface-id]
[address]
Step 7 copy running-config startup-config
Switch(config)# interface GigabitEthernet 0/8
Switch(config-if)# switchport private-vlan mapping 2061 2201-2206,3101
Switch(config-if)# switchport mode private-vlan promiscuous
Switch(config-if)# switchport port-security maximum 288
Switch(config-if)# switchport port-security
Switch(config-if)# switchport port-security violation restrict
Note Ports that have both port security and private VLANs configured can be labeled secure PVLAN ports.
When a secure address is learned on a secure PVLAN port, the same secure address cannot be learned
on another secure PVLAN port belonging to the same primary VLAN. However, an address learned on
unsecure PVLAN port can be learned on a secure PVLAN port belonging to same primary VLAN.
Secure addresses that are learned on host port get automatically replicated on associated primary
VLANs, and similarly, secure addresses learned on promiscuous ports automatically get replicated on
all associated secondary VLANs. Static addresses (using mac-address-table static command) cannot be
user configured on a secure port.
OL-8915-03
Purpose
Enter global configuration mode.
Specify the interface to be configured, and enter interface
configuration mode.
Enable a private vlan on the interface.
Enable port security on the interface.
Return to privileged EXEC mode.
Verify your entries.
(Optional) Save your entries in the configuration file.
Cisco Catalyst Blade Switch 3020 for HP Software Configuration Guide
Configuring Port Security
23-19