29-8
Cisco IE 2000 Switch Software Configuration Guide
OL-25866-01
Chapter 29 Configuring Port-Based Traffic Control
Information About Port-Based Traffic Control

Port Security Aging

You can use port security aging to set the aging time for all secure addresses on a port. Two types of
aging are supported per port:
• Absolute—The secure addresses on the port are deleted after the specified aging time.
• Inactivity—The secure addresses on the port ar e deleted only if the secure addresses are inactive for
the specified aging time.
Use this feature to remove and add devices on a secure port without manually deleting the existing secure
MAC addresses and to still limit the number of secure addresses on a port. You can enable or disable the
aging of secure addresses on a per-port basis.

Port Security and Private VLANs

Ports that have both port security and private VLANs (PVLANs) configured can be labeled secure
PVLAN ports. When a secure address is learned on a secure PVLAN port, the same secure address
cannot be learned on another secure PVLAN port belonging to the same primary VLAN. However, an
address learned on unsecure PVLAN port can be learned on a secure PVLAN port belonging to same
primary VLAN.
Secure addresses that are learned on host port get automat ically replicated on associated primary
VLANs, and similarly, secure addresses learned on promiscuous ports automatic ally get replicated on
all associated secondary VLANs. Static addresses (using the mac-address-table static command)
cannot be user configured on a secure port.
Protocol Storm Protection
When a switch is flooded with Address Resolution Protocol (ARP) or control packets, high CPU
utilization can cause the CPU to overload. These issues can occur:
• Routing protocol can flap because the protocol control packet s are not received, and neighboring
adjacencies are dropped.
• Spanning Tree Protocol (STP) reconverges because the STP bridge protocol data unit (BPDU)
cannot be sent or received.
• CLI is slow or unresponsive.
Using protocol storm protection, you can control the rate at which control packets are sent to the sw itch
by specifying the upper threshold for the packet flow rate. The supported protocols are ARP, ARP
snooping, Dynamic Host Configuration Protocol (DHCP) v4, DHCP snooping, Interne t Group
Management Protocol (IGMP), and IGMP snooping.
When the packet rate exceeds the defined threshold, the switch drops all traffic arriving on the specified
virtual port for 30 seconds. The packet rate is measured again, and protocol storm protection is again
applied if necessary.
For further protection, you can manually error disable the virtual port, blocking all incoming traffic on
the virtual port. You can manually enable the virtual port or set a time interval for automatic reenabling
of the virtual port.
Note Excess packets are dropped on no more than two virtual ports.
Virtual port error disabling is not supported for EtherChannel and Flex Link interfaces.