Configuring The Port Security Violation Mode On A Port - Cisco WS-SUP32-GE-3B - Supervisor Engine 32 Software Configuration Manual

Configuring Port Security
This example shows how to enable port security on Fast Ethernet port 5/12:
Router# configure terminal
Enter configuration commands, one per line.
Router(config)# interface fastethernet 5/12
Router(config-if)# switchport
Router(config-if)# switchport mode access
Router(config-if)# switchport port-security
Router(config-if)# do show port-security interface fastethernet 5/12 | include Port Security
Port Security

Configuring the Port Security Violation Mode on a Port

To configure the port security violation mode on a port, perform this task:
Command
Step 1
Router(config)# interface type
Step 2
Router(config-if)# switchport port-security
violation {protect | restrict | shutdown}
Router(config-if)# no switchport port-security
violation
Step 3
Router(config-if)# do show port-security
1
interface type
2
violation_mode
1. type = ethernet, fastethernet, gigabitethernet, or tengigabitethernet
2. violation_mode = protect, restrict, or shutdown
When configuring port security violation modes, note the following information:
•
•
•
This example shows how to configure the protect security violation mode on Fast Ethernet port 5/12:
Router# configure terminal
Enter configuration commands, one per line.
Router(config)# interface fastethernet 3/12
Router(config-if)# switchport port-security violation protect
Router(config-if)# do show port-security interface fastethernet 5/12 | include Protect
Violation Mode
Catalyst Supervisor Engine 32 PISA Cisco IOS Software Configuration Guide, Release 12.2ZY
43-6
1
slot/port
slot/port | include
protect—Drops packets with unknown source addresses until you remove a sufficient number of
secure MAC addresses to drop below the maximum value.
restrict—Drops packets with unknown source addresses until you remove a sufficient number of
secure MAC addresses to drop below the maximum value and causes the SecurityViolation counter
to increment.
shutdown—Puts the interface into the error-disabled state immediately and sends an SNMP trap
notification.
To bring a secure port out of the error-disabled state, enter the errdisable recovery cause
Note
violation_mode global configuration command, or you can manually reenable it by entering
the shutdown and no shut down interface configuration commands.
End with CNTL/Z.
: Enabled
Purpose
Selects the LAN port to configure.
(Optional) Sets the violation mode and the action to be
taken when a security violation is detected.
Reverts to the default configuration (shutdown).
Verifies the configuration.
End with CNTL/Z.
: Protect
Chapter 43 Configuring Port Security
OL-11439-03