Cisco Systems 3750E Default Port Security Configuration, Port Security Configuration Guidelines

Chapter 26 Configuring Port-Based Traffic Control

Configuring Port Security

Table 26-1	Security Violation Mode Actions
						Violation
		Traffic is	Sends SNMP	Sends syslog	Displays error	counter
Violation Mode		forwarded1	trap	message	message2	increments	Shuts down port
protect		No	No	No	No	No	No
restrict		No	Yes	Yes	No	Yes	No
shutdown		No	Yes	Yes	No	Yes	Yes
shutdown vlan		No	Yes	Yes	No	Yes	No3

1.Packets with unknown source addresses are dropped until you remove a sufficient number of secure MAC addresses.

2.The switch returns an error message if you manually configure an address that would cause a security violation.

3.Shuts down only the VLAN on which the violation occurred.

Default Port Security Configuration

Table 26-2shows the default port security configuration for an interface.

Table 26-2 Default Port Security Configuration

Feature	Default Setting
Port security	Disabled on a port.
Sticky address learning	Disabled.
Maximum number of secure	1.
MAC addresses per port
Violation mode	Shutdown. The port shuts down when the maximum number of
	secure MAC addresses is exceeded.
Port security aging	Disabled. Aging time is 0.
	Static aging is disabled.
	Type is absolute.

Port Security Configuration Guidelines

Follow these guidelines when configuring port security:

•Port security can only be configured on static access ports or trunk ports. A secure port cannot be a dynamic access port.

•A secure port cannot be a destination port for Switched Port Analyzer (SPAN).

•A secure port cannot belong to a Gigabit EtherChannel port group.

Note Voice VLAN is only supported on access ports and not on trunk ports, even though the configuration is allowed.

	Catalyst 3750-E and 3560-E Switch Software Configuration Guide
26-10	OL-9775-02