U
SER
A
UTHENTICATION
3-57
intrusion will be detected and the switch can automatically take action by
disabling the port and sending a trap message.
To use port security, first allow the switch to dynamically learn the <source
MAC address, VLAN> pair for frames received on a port for an initial
training period, and then enable port security to stop address learning. Be
sure you enable the learning function long enough to ensure that all valid
VLAN members have been registered on the selected port. Note that you
can also restrict the maximum number of addresses that can be learned by
a port.
To add new VLAN members at a later time, you can manually add secure
addresses with the Static Address Table (page3-122), or turn off port
security to reenable the learning function long enough for new VLAN
members
to be registered. Learning may then be disabled again, if desired,
for security.
Command Usage
• A secure port has the following restrictions:
- Cannot use port monitoring.
- Cannot be a multi-VLAN port.
- It cannot be used as a member of a static or dynamic trunk .
- It should not be connected to a network interconnection device.
• If a port is disabled (shut down) due to a security violation, it must be
manually re-enabled from the Port/Port Configuration page
(page 3-93).
Command Attributes
•Port – Port number.
•Name – Descriptive text (page 3-2).
•Action – Indicates the action to be taken when a port security violation
is detected:
-None: No action should be taken. (This is the default.)
-Trap: Send an SNMP trap message.