Cisco Systems 3750E manual 26-15, Switchconfig-if#switchport port-security

Chapter 26 Configuring Port-Based Traffic Control

Configuring Port Security

	To return the interface to the default condition as not a secure port, use the no switchport port-security
	interface configuration command. If you enter this command when sticky learning is enabled, the sticky
	secure addresses remain part of the running configuration but are removed from the address table. All
	addresses are now dynamically learned.
	To return the interface to the default number of secure MAC addresses, use the no switchport
	port-security maximum value interface configuration command. To return the violation mode to the
	default condition (shutdown mode), use the no switchport port-security violation {protocol restrict}
	interface configuration command.
	To disable sticky learning on an interface, use the no switchport port-securitymac-address sticky
	interface configuration command. The interface converts the sticky secure MAC addresses to dynamic
	secure addresses. However, if you have previously saved the configuration with the sticky MAC
	addresses, you should save the configuration again after entering the no switchport port-security
	mac-address sticky command, or the sticky addresses will be restored if the switch reboots.
	Use the clear port-security {all configured dynamic sticky} privileged EXEC command to delete
	from the MAC address table all secure addresses or all secure addresses of a specific type (configured,
	dynamic, or sticky) on the switch or on an interface.
	To delete a specific secure MAC address from the address table, use the no switchport port-security
	mac-addressmac-addressinterface configuration command. To delete all dynamic secure addresses on
	an interface from the address table, enter the no switchport port-securityinterface configuration
	command followed by the switchport port-securitycommand (to re-enable port security on the
	interface). If you use the no switchport port-securitymac-address sticky interface configuration
	command to convert sticky secure MAC addresses to dynamic secure MAC addresses before entering
	the no switchport port-securitycommand, all secure addresses on the interface except those that were
	manually configured are deleted.
	You must specifically delete configured secure MAC addresses from the address table by using the no
	switchport port-security mac-address mac-addressinterface configuration command.
	This example shows how to enable port security on a port and to set the maximum number of secure
	addresses to 50. The violation mode is the default, no static secure MAC addresses are configured, and
	sticky learning is enabled.
	Switch(config)# interface gigabitethernet1/0/1
	Switch(config-if)#switchport mode access
	Switch(config-if)#switchport port-security
	Switch(config-if)#switchport port-security maximum 50
	Switch(config-if)#switchport port-security mac-address sticky
	This example shows how to configure a static secure MAC address on VLAN 3 on a port:
	Switch(config)# interface gigabitethernet1/0/2
	Switch(config-if)#switchport mode trunk
	Switch(config-if)#switchport port-security
	Switch(config-if)#switchport port-security mac-address 0000.02000.0004 vlan 3
	This example shows how to enable sticky port security on a port, to manually configure MAC addresses
	for data VLAN and voice VLAN, and to set the total maximum number of secure addresses to 20 (10 for
	data VLAN and 10 for voice VLAN).
	Switch(config)# interface tengigabitethernet1/0/1
	Switch(config-if)#switchport access vlan 21
	Switch(config-if)#switchport mode access
	Switch(config-if)#switchport voice vlan 22
	Switch(config-if)#switchport port-security
	Switch(config-if)#switchport port-security maximum 20
	Switch(config-if)#switchport port-security violation restrict
	Switch(config-if)#switchport port-security mac-address sticky
	Switch(config-if)#switchport port-security mac-address sticky 0000.0000.0002
	Catalyst 3750-E and 3560-E Switch Software Configuration Guide
OL-9775-02		26-15