542 Configuring Port and System Security

Configuring Port Security (CLI)

Beginning in Privileged EXEC mode, use the following commands to enable port security on an interface to limit the number of source MAC addresses that can be learned.
19
Command Purpose
configure Enter Global Configuration mode.
interface
interface
Enter interface configuration mode for the specified
interface. The
interface
variable includes the interface type
and number, for example tengigabitethernet 1/0/3.
You can also specify a range of interfaces with the interface
range command, for example, interface range
tengigabitethernet 1/0/8-12 configures interfaces 8, 9, 10,
11, and 12.
port security [discard]
[trap
seconds
]
Enable port security on the port. This prevents the switch
from learning new addresses on this port after the
maximum number of addresses has been learned.
•
discard
— Discards frames with unlearned source
addresses. This is the default if no option is indicated.
•
trap
seconds
— Sends SNMP traps and defines the
minimal amount of time in seconds between two
consecutive traps. (Range: 1–1000000)
port security max

max-

addr

Set the maximum number of MAC addresses that can be
learned on the port while port security is enabled.
CTRL + Z Exit to Privileged EXEC mode.
show ports security
[
interface
]
View port security settings on all interfaces or the specified
interface.
show ports security
addresses [
interface
]
View the current MAC addresses that have been learned
on all ports or the specified port.