Configuring Port Security Aging - Cisco 6500 Series Software Configuration Manual

Configuring Port Security
When port security is enabled, if an address learned or configured on one secure interface is seen on
Note
another secure interface in the same VLAN, port security puts the interface into the error-disabled state
immediately.
To bring a secure port out of the error-disabled state, enter the errdisable recovery cause
psecure_violation global configuration command or you can manually reenable it by entering the
shutdown and no shut down interface configuration commands.
To return the interface to the default condition (not a secure port), enter the no switchport port-security
interface configuration command.
To return the interface to the default number of secure MAC addresses, enter the no switchport
port-security maximum value command.
To delete a MAC address from the address table, enter the no switchport port-security mac-address
mac_address command.
To return the violation mode to the default condition (shutdown mode), enter the no switchport
port-security violation {protocol | restrict} command.
This example shows how to enable port security on Fast Ethernet port 12 and to set the maximum number
of secure addresses to 5. The violation mode is the default, and no secure MAC addresses are configured.
Router# configure terminal
Enter configuration commands, one per line.
Router(config)# interface fastethernet 3/12
Router(config-if)# switchport mode access
Router(config-if)# switchport port-security
Router(config-if)# switchport port-security maximum 5
Router(config-if)# end
Router# show port-security interface fastethernet 3/12
Security Enabled:Yes, Port Status:SecureUp
Violation Mode:Shutdown
Max. Addrs:5, Current Addrs:0, Configure Addrs:0
This example shows how to configure a secure MAC address on Fast Ethernet port 12 and verify the
configuration:
Router# configure terminal
Enter configuration commands, one per line.
Router(config)# interface fastethernet 5/12
Router(config-if)# switchport mode access
Router(config-if)# switchport port-security
Router(config-if)# switchport port-security mac-address 1000.2000.3000
Router(config-if)# end
Router# show port-security address
------------------------------------------------------------
Vlan
----
1

Configuring Port Security Aging

You can use port security aging to set the aging time for all secure addresses on a port.
Use this feature to remove and add PCs on a secure port without manually deleting the existing secure
MAC addresses while still limiting the number of secure addresses on a port.
Catalyst 6500 Series Switch Cisco IOS Software Configuration Guide—Release 12.1 E
26-4
Secure Mac Address Table
Mac Address Type
----------- ----
1000.2000.3000 SecureConfigured
Chapter 26
End with CNTL/Z.
End with CNTL/Z.
Ports
-----
Fa5/12
Configuring Port Security
78-14099-04