Cisco Catalyst 3750 Command Reference Manual page 604
Hide thumbs
Also See for Catalyst 3750:
- Command reference manual (1154 pages) ,
- Software configuration manual (926 pages) ,
- Hardware installation manual (231 pages)
Table of Contents
Advertisement
switchport port-security
protect
restrict
shutdown
Defaults
The default is to disable port security.
When port security is enabled and no keywords are entered, the default maximum number of secure
MAC addresses is 1.
The default violation mode is shutdown.
Sticky learning is disabled.
Command Modes
Interface configuration
Command History
Release
12.1(11)AX
12.1(14)EA1
Usage Guidelines
A secure port has the following limitations:
•
•
•
•
Catalyst 3750 Switch Command Reference
2-576
Modification
This command was introduced.
The sticky and vlan keywords were added.
A secure port can be an access port or a trunk port; it cannot be a dynamic access port.
A secure port cannot be a routed port.
A secure port cannot be a protected port.
A secure port cannot be a destination port for Switched Port Analyzer (SPAN).
Set the security violation protect mode. In this mode, when the number
of port secure MAC addresses reaches the maximum limit allowed on
the port, packets with unknown source addresses are dropped until you
remove a sufficient number of secure MAC addresses to drop below the
maximum value or increase the number of maximum allowable
addresses. You are not notified that a security violation has occurred.
We do not recommend configuring the protect mode on a trunk
Note
port. The protect mode disables learning when any VLAN
reaches its maximum limit, even if the port has not reached its
maximum limit.
Set the security violation restrict mode. In this mode, when the number
of secure MAC addresses reaches the limit allowed on the port, packets
with unknown source addresses are dropped until you remove a
sufficient number of secure MAC addresses or increase the number of
maximum allowable addresses. An SNMP trap is sent, a syslog message
is logged, and the violation counter increments.
Set the security violation shutdown mode. In this mode, the interface is
error-disabled when a violation occurs and the port LED turns off. An
SNMP trap is sent, a syslog message is logged, and the violation counter
increments. When a secure port is in the error-disabled state, you can
bring it out of this state by entering the errdisable recovery cause
psecure-violation global configuration command, or you can manually
re-enable it by entering the shutdown and no shut down interface
configuration commands.
Chapter 2 Catalyst 3750 Switch Cisco IOS Commands
78-16181-03
Advertisement
Table of Contents
