30-8
Software Configuration Guide—Release 12.2(25)EWA
OL-6850-03
Chapter30 Configuring Port Security and Trunk Port Security
Configuring Port Security
You can configure various port security related parameters on a per-port per-VLAN basis.
To configure port security related parameters on a per-VLAN per-port basis, perform this task:
This example shows how to configure a secure MAC-address and a maximum limit of secure MAC
addresses on interface g1/1:
Switch(config)# interface g1/1
Switch(config-if)# switchport trunk encapsulation dot1q
Switch(config-if)# sw mode trunk
Switch(config-if)# switchport port-security
Switch(config-if)# switchport port-security maximum 33
Switch(config-if)# switchport port-security mac-address sticky
Switch(config-if)# vlan 2-6
Switch(config-if-vlan-range)# port-security maximum 3
Switch(config-if-vlan-range)# port-security mac-address 1.1.1
Switch(config-if-vlan-range)# port-security mac-address sticky 1.1.2
Switch(config-if-vlan-range)# port-security mac-address sticky 1.1.3
Switch(config-if-vlan-range)#
Switch# show port-security interface g1/1 vlan
Default maximum: not set, using 3072
VLAN Maximum Current
2 3 3
3 3 3
4 3 3
5 3 3
6 3 3
Command Purpose
Step1 Switch(config)# interface
interface_id
Enters interface configuration mode and specifies the
physical interface to configure.
Step2 Switch(config-if)# switchport port-security
maximum
value
vlan
Configures a maximum number of secure mac-addresses
for all the VLANs that are not explicitly configured for a
maximum mac-address limit.
Step3 Switch(config-if)# vlan-range
range
Enters VLAN range sub-mode.
Note You can specify single or multiple VLANs.
Step4 Switch(config-if-vlan-range)#
port-security maximum
value
Configures a maximum number of secure MAC addresses
for all the VLANs that have not been configured
explicitly with a maximum value.
If a maximum value is configured for a specific VLAN, it
will overwrite the value specified by this CLI.
Step5 Switch(config-if-vlan-range)#
no port-security maximum
Removes a maximum number of secure MAC addresses
configuration for all the VLANs. Subsequently, the
maximum value configured on the port will be used for all
the VLANs.
Step6 Switch(config-if-vlan-range)# [no] port-security
mac-address
mac_address
Configures a secure MAC-address on a specific VLAN
range of VLANs.
Step7 Switch(config-if-vlan-range)# [no] port-security
mac-address sticky
mac_address
Configures a sticky MAC-address on a specific VLAN
range of VLANs.
Step8 Switch(config-if-vlan-range)# end Returns to interface configuration m ode.
Step9 Switch(config-if)# end Returns to privileged EXEC mode.