18-9
Catalyst 2950 Desktop Switch Software Configuration Guide
78-14982-01
Chapter 18 Configuring Port -Based Traffic Control Configuring Port Security
To return t he inter face to the de fault conditi on as not a secure p ort, use th e no switchport port -security
interf ace co nf igurati on com mand. If you enter this comman d when sticky learnin g is enab led, the sticky
secure addresses re main part of the runni ng configurati on but are removed from the a ddress tab le. The
addr esses that were re moved can be dynami cally recon figured and added to the ad dress table as d ynamic
addresses.
To return t he interfac e to the defau lt number of sec ure MAC addresses, use the no switchport
port-security maxi mum value interface configuration command.
To return t he violati on mode to the de fault con dition (shu tdown mode), use the no switchport
port-secur ity violatio n {protocol | restrict} interface c onfiguration command.
To disable sticky learning on an interface, use the no switchport port-security mac-address sticky
interface configuration command. The interface converts the sticky secure MAC addresses to dynamic
secure addr esses.
To delete a static secure MAC address from the address table, use the no switchport port-security
mac-address mac-address interface configuration command.
To delet e a d yna mic secu re MAC address fro m the ad dress t able, use the clear port-security dynamic
address mac-addr privileged EXEC command. To delete all the dynamic addresses on an interface, use
the clear por t-sec urit y dyn amic in terf ace interface-id privileged EXEC command.
To delete sticky secure MAC addresses from the address table, d isable sticky learning, which converts
the sticky secure MAC addresses to dynamic secure addresses. Use the no switchport port-security
mac-address sticky i nterface configuration command. Delete dynamic secure addresses on an interface
by using the clear port-security dynamic interface inter f a c e - i d privileged EXEC command. To delete
a dy nami c se cure M AC address, u se t he clear port-security dynamic address mac-addr privileged
EXEC command.
This example shows ho w to enable port security on Fast Ethernet port 1 and to set the maximum number
of secu re a ddr esses to 5 0. The vio lat ion mo de i s the default , no stat ic sec ure M AC addresses a re
configured , and stic ky learnin g is enab led.
Switch# configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
Switch(config)# interface fastethernet0/1
Switch(config-if)# switchport mode access
Switch(config-if)# switchport port-security
Switch(config-if)# switchport port-security maximum 50
Switch(config-if)# switchport port-security mac-address sticky
Switch(config-if)# end
Switch# show port-security interface fastethernet0/1
Port Security: Enabled
Port status: SecureUp
Violation mode: Shutdown
Maximum MAC Addresses :50
Total MAC Addresses: 11
Configured MAC Addresses: 0
Sticky MAC Addresses :11
Aging time: 20 mins
Aging type: Inactivity
SecureStatic address aging: Enabled
Security Violation count: 0