18-6
Catalyst 2950 Desktop Switch Software Configuration Guide
78-14982-01
Chapter 18 Configuring Port-Based Traffic Control
Configuring Port Security
This i s a n exampl e of t ext fr om the r unn ing co nfigurat ion w hen st ic ky lea rni ng is en ab led on an
interface:
<output truncated>
!
interface FastEthernet0/2
switchport mode access
switchport port-security
switchport port-security maximum 6
switchport port-security aging time 5
switchport port-security aging static
switchport port-security mac-address sticky
switchport port-security mac-address 0000.0000.000b
switchport port-security mac-address sticky 0000.0000.4141
switchport port-security mac-address sticky 0000.0000.5050
no ip address
<output truncated>
If port sec urit y i s d isabl ed, the s ticky secur e M AC ad dresse s r ema in i n t he r unnin g c on figuration.
To disable sticky learning, enter the no switchport port-security mac-address sticky interface
configuration command. If sticky learning is disabled or the running configuration is removed, the sticky
secure MA C addresses remain part of the running configuration but are remov ed from the address table.
The ad dresses that were removed can be dynamic ally reco nfigured and a dded to the add ress table as
dynami c addresse s.
Note If stick y lear n ing is d is ab led , whe n the s wi tch restarts or th e in ter f a ce shu ts down, all the addre s ses th at
were dyn amica lly le arned ar e removed.

Security Violations

It is a security violation when one of these situations occurs:
•The maximum number of secure MAC addresses have been added to the address table, and a station
whose MAC address is not in the address table attempts to access the interface.
•An addr ess le ar ned or co nfigured on on e se c ure i nte rface i s see n on ano the r se cu re in ter face in t he
same VLAN.
You can co nfigure the in terface fo r one of thre e violat ion modes, based on the action to be ta ken if a
violatio n occ urs :
•protect—when the number of sec ure MAC addresses reache s the maxi mum limit al lowed on the
port, packets with unknown source addresses are dropped until you remove a sufficient number of
secure MAC addresses to dr op bel ow the ma ximu m value.
•restrict—a port security violation restricts data and causes the SecurityViolation counter to
increment. It also sends an SNMP trap when an address-security violation occurs.
•shutdown—the interface is error-disabled when a security violation occurs. When a secure port is
in the error-disabled state, you can bring it out of this state by entering the errdisable recovery
cause psec ure-violation gl obal con figuration co mmand, or yo u can manua lly re-en able it by
ent erin g th e shutdown and no shutdown interface configuration commands. This is the default
mode.