Cisco Systems 4500 Port Security Configuration Guidelines and Restrictions

43-33
Software Configuration Guide—Release 15.0(2)SG
OL-23818-01
Chapter 43 Configuring Port Security Port Security Configuration Guidelines and Restrictions
Figure 43-3 Port Security in a Wireless Environment
Configuring Port Security over Layer 2 EtherChannel
Note Catalyst 4900M, Catalyst 4948E, Supervisor Engine 6-E, and Supervisor Engine 6L-E do not support
this feature.
Port security can be enabled on an EtherChannel in either trunk or access mode. Refer to the
“Configuring Port Security on Access Ports” section on page 43-7 and the “Configuring Port Security
on Trunk Ports” section on page 43-17 for configuration steps.)
When you do this in trunking mode, the MAC address restrictions apply to the entire port-channel on a
per-VLAN basis.
In general, be aware of the following:
• Port security on Layer 2 EtherChannel works only on access mode or trunk mode and is independent
of the configuration on any physical member ports.
• If at least one member port is secured, port security cannot be disabled on the channel interface; it
is rejected by the CLI.
• A secure port cannot join a non-secure EtherChannel; it is rejected by the CLI.
• Port security over EtherChannel is supported in both PAgP and LACP modes. It does not apply to
Layer 3 EtherChannels.
Port Security Configuration Guidelines and Restrictions
When using (or configuring) port security, consider these guidelines and restrictions:
• After port security is configured on a port along with a "denying" PACL, the CPU will neither see
any of the PACL packets denied from the given port nor learn the source MAC addresses from the
denied packets. Therefore, the port security feature will not be aware of such packets.
• A secure port cannot be a destination port for the Switch Port Analyzer (SPAN).
• A secure port and a static MAC address configuration for an interface are mutually exclusive.
Wireless laptop
"roamed" out AP2
Wireless laptop
associated with AP1
140990
AP1 AP2
Switch