Port Security And Private Vlans - Cisco WS-CBS3032-DEL Software Configuration Manual

Configuring Port Security

Port Security and Private VLANs

Port security allows an administrator to limit the number of MAC addresses learned on a port or to define
which MAC addresses can be learned on a port.
Beginning in privileged EXEC mode, follow these steps to configure port security on a PVLAN host and
promiscuous ports:
Command
Step 1 configure terminal
Step 2 interface interface-id
Step 3 switchport mode private-vlan {host |
promiscuous}
Step 4
switchport port-security
Step 5
end
Step 6 show port-security [interface interface-id]
[address]
Step 7 copy running-config startup-config
This example shows how to configure port security on a PVLAN host and promiscuous ports
Switch(config)# interface gigabitethernet 1/0/8
Switch(config-if)# switchport private-vlan mapping 2061 2201-2206,3101
Switch(config-if)# switchport mode private-vlan promiscuous
Switch(config-if)# switchport port-security maximum 288
Switch(config-if)# switchport port-security
Switch(config-if)# switchport port-security violation restrict
Ports that have both port security and private VLANs configured can be labeled secure PVLAN ports.
Note
When a secure address is learned on a secure PVLAN port, the same secure address cannot be learned
on another secure PVLAN port belonging to the same primary VLAN. However, an address learned on
unsecure PVLAN port can be learned on a secure PVLAN port belonging to same primary VLAN.
Secure addresses that are learned on host port get automatically replicated on associated primary
VLANs, and similarly, secure addresses learned on promiscuous ports automatically get replicated on
all associated secondary VLANs. Static addresses (using mac-address-table static command) cannot be
user configured on a secure port.
Cisco Catalyst Blade Switch 3130 and 3032 for Dell Software Configuration Guide
26-20
Chapter 26
Purpose
Enter global configuration mode.
Specify the interface to be configured, and enter interface
configuration mode.
Enable a private vlan on the interface.
Enable port security on the interface.
Return to privileged EXEC mode.
Verify your entries.
(Optional) Save your entries in the configuration file.
Configuring Port-Based Traffic Control
OL-13270-06