Configuring Port Security; Configuring Port Security On An Interface - Cisco 6500 Series Software Configuration Manual

Chapter 26

Configuring Port Security

Configuring Port Security
These sections describe how to configure port security:
•
•

Configuring Port Security on an Interface

To restrict traffic through a port by limiting and identifying MAC addresses of the stations allowed to
access the port, perform this task:
Command
Step 1
Router(config)# interface interface_id
Step 2
Router(config-if)# switchport mode access
Step 3
Router(config-if)# switchport port-security
Step 4
Router(config-if)# switchport port-security
maximum value
Step 5
Router(config-if)# switchport port-security
violation {protect | restrict | shutdown}
Step 6
Router(config-if)# switchport port-security
mac-address mac_address
Step 7
Router(config-if)# end
Step 8
Router# show port-security interface interface_id
Router# show port-security address
When configuring port security, note the following syntax information about port security violation
modes:
•
•
•
78-14099-04
Configuring Port Security on an Interface, page 26-3
Configuring Port Security Aging, page 26-4
protect—Drops packets with unknown source addresses until you remove a sufficient number of
secure MAC addresses to drop below the maximum value.
restrict—Drops packets with unknown source addresses until you remove a sufficient number of
secure MAC addresses to drop below the maximum value and causes the SecurityViolation counter
to increment.
shutdown—Puts the interface into the error-disabled state immediately and sends an SNMP trap
notification.
Catalyst 6500 Series Switch Cisco IOS Software Configuration Guide—Release 12.1 E
Purpose
Enters interface configuration mode and enters the
physical interface to configure, for example,
gigabitethernet 3/1.
Sets the interface mode as access; an interface in the
default mode (dynamic desirable) cannot be configured as
a secure port.
Enables port security on the interface.
(Optional) Sets the maximum number of secure MAC
addresses for the interface. The range is 1 to 128; the
default is 128.
(Optional) Sets the violation mode and the action to be
taken when a security violation is detected.
(Optional) Enters a secure MAC address for the interface.
You can use this command to enter the maximum number
of secure MAC addresses. If you configure fewer secure
MAC addresses than the maximum, the remaining MAC
addresses are dynamically learned.
Returns to privileged EXEC mode.
Verifies your entries.
Configuring Port Security
26-3