Cisco Systems 4500 Configuring Port Security with Other Features/Environments

43-31
Software Configuration Guide—Release 15.0(2)SG
OL-23818-01
Chapter 43 Configuring Port Security Configuring Port Security with Other Features/Environments
Example 7: Displaying Secured MAC Addresses for a VLAN Range on an Interface
This example shows how to display all secure MAC addresses configured on VLANs 2 and 3 on
Gigabit Ethernet interface 1/1 with aging information for each address:
Switch# show port-security interface g1/1 address vlan 2-3
Secure Mac Address Table
------------------------------------------------------------------------
Vlan Mac Address Type Ports Remaining Age(mins)
---- ----------- ---- ----- -------------
2 0001.0001.0001 SecureConfigured Gi1/1 -
2 0001.0001.0002 SecureSticky Gi1/1 -
2 0001.0001.0003 SecureSticky Gi1/1 -
3 0001.0001.0001 SecureConfigured Gi1/1 -
3 0001.0001.0002 SecureSticky Gi1/1 -
3 0001.0001.0003 SecureSticky Gi1/1 -
------------------------------------------------------------------------
Total Addresses: 12
Switch#
Configuring Port Security with Other Features/Environments
The following topics are discussed:
• DHCP and IP Source Guard, page 43-31
• 802.1X Authentication, page 43-32
• Configuring Port Security in a Wireless Environment, page 43-32
• Configuring Port Security over Layer 2 EtherChannel, page 43-33
DHCP and IP Source Guard
You might want to configure port security with DHCP and IP Source Guard to prevent IP spoofing by
unsecured MAC addresses. IP Source Guard supports two levels of IP traffic filtering:
• Source IP address filtering
• Source IP and MAC address filtering
When used in source IP and MAC address filtering, IP Source Guard uses private ACLs to filter traffic
based on the source IP address, and uses port security to filter traffic based on the source MAC address.
Port security must be enabled on the access port in this mode.
When both features are enabled, the following limitations apply:
• The DHCP packet is not subject to port security dynamic learning.
• If multiple IP clients are connected to a single access port, port security cannot enforce exact binding
of source IP and MAC address for each client.
For example, these clients reside on an access port with the following IP and MAC address:
– client1: MAC1 <---> IP1
– client2: MAC2 <---> IP2