21-6
Catalyst 2960 Switch SoftwareConfiguration Guide
78-16881-01
Chapter21 Configuring Port-Based Traffic Control
Configuring Port Blocking

Protected Port Configuration Guidelines

You can configure protected ports on a physical interface (for example, Gigabit Ethernet port 1) or an
EtherChannel group (for example, port-channel 5). When you enable protec ted ports for a port channel,
it is enabled for all ports in the port-channel group.

Configuring a Protected Port

Beginning in privileged EXEC mode, follow these steps to define a port as a protected port:
To disable protected port, use the no switchport protected interface configuration command.
This example shows how to configure a port as a protected port:
Switch# configure terminal
Switch(config)# interface gigabitethernet0/1
Switch(config-if)# switchport protected
Switch(config-if)# end
Configuring Port Blocking
By default, the switch floods packets with unknown destination MAC addresses out of all po rts. If
unknown unicast and multicast traffic is forwarded to a protected port, there could be security issues. To
prevent unknown unicast or multicast traffic from being forwarded from one port to another, you can
block a port (protected or nonprotected) from flooding unknown unicast or multicast packets to other
ports.
These sections contain this configuration information:
Default Port Blocking Configuration, page 21-6
Blocking Flooded Traffic on an Interface, page 21-7

Default Port Blocking Configuration

The default is to not block flooding of unknown multicast and unicast traffic out of a port, but to flood
these packets to all ports.
Command Purpose
Step1 configure terminal Enter global configuration mode.
Step2 interface interface-id Specify the interface to be configured, and enter interface
configuration mode.
Step3 switchport protected Configure the interface to be a protected port.
Step4 end Return to privileged EXEC mode.
Step5 show interfaces interface-id switchport Verify your entries.
Step6 copy running-config startup-config (Optional) Save your entries in the configuration file.