Cisco Systems 4500 Aging Secure MAC Addresses, Sticky Addresses on a Port

43-5
Software Configuration Guide—Release 15.0(2)SG
OL-23818-01
Chapter 43 Configuring Port Security About Port Security
Note On a trunk port, a maximum number of secure MAC addresses can be configured on both the port and
port VLAN. The port’s maximum value can be greater than or equal to the port VLAN maximum(s) but
not less than the port VLAN maximum(s). If the port’s maximum value is less than at least one of the
port VLAN’s maximum (for example, if we have max set to 3 on VLAN 10 while no “sw port max” is
set (defaults to 1)), the port shuts down when dynamic adds reaches 2 on VLAN 10 (see “Port Security
Configuration Guidelines and Restrictions” on page 33). The port VLAN maximum enforces the
maximum allowed on a given port on a given VLAN. If the maximum is exceeded on a given VLAN but
the port’s maximum is not exceeded, the port still shuts down. The entire port is shut down even if one
of the VLANs on the port has actually caused the violation.
Aging Secure MAC Addresses
You might want to age secure MAC addresses when the switch may be receiving more than 3,000 MAC
addresses ingress.
Note Aging of sticky addresses is not supported.
By default, port security does not age out the secure MAC addresses. After learned, the MAC addresses
remain on the port until either the switch reboots or the link goes down (unless the sticky feature is
enabled). However, port security does allow you to configure aging based on the absolute or inactivity
mode and aging interval (in minutes, from 1 to n).
• Absolute mode—Ages between n and n+1
• Inactivity mode—Ages between n+1 and n+2
Use this feature to remove and add PCs on a secure port without manually deleting the existing secure
MAC addresses, while still limiting the number of secure addresses on a port.
Unless static aging is explicitly configured with the switchport port-security aging static command,
static addresses are not aged even if aging is configured on the port.
Note The aging increment is one minute.
Sticky Addresses on a Port
By enabling sticky port security, you can configure an interface to convert the dynamic MAC addresses
to sticky secure MAC addresses and to add them to the running configuration. You might want to do this
if you do not expect the user to move to another port, and you want to avoid statically configuring a MA C
address on every port.
Note If you use a different chassis, you might need another MAC address.
To enable sticky port security, enter the switchport port-security mac-address sticky command. When
you enter this command, the interface converts all the dynamic secure MAC addresses, including those
that were dynamically learned before sticky learning was enabled, to sticky secure MAC addresses.