Cisco Systems 3560 Manual De Usuario

 shows the default port security configuration for an interface.

Follow these guidelines when configuring port security:

Port security can only be configured on static access ports or trunk ports. A secure port cannot be a 
dynamic access port.

A secure port cannot be a destination port for Switched Port Analyzer (SPAN). 

A secure port cannot belong to a Fast EtherChannel or a Gigabit EtherChannel port group.

Voice VLAN is only supported on access ports and not on trunk ports, even though the 
configuration is allowed. 

When you enable port security on an interface that is also configured with a voice VLAN, set the 
maximum allowed secure addresses on the port to two. When the port is connected to a Cisco IP 
phone, the IP phone requires one MAC address. The Cisco IP phone address is learned on the voice 

shutdown

No

Yes

Yes

No

Yes

Yes

shutdown vlan

No

Yes

Yes

No

Yes

No

3

1.

Packets with unknown source addresses are dropped until you remove a sufficient number of secure MAC addresses.

2.

The switch returns an error message if you manually configure an address that would cause a security violation.

3.

Shuts down only the VLAN on which the violation occurred.

Port security

Disabled on a port.

Sticky address learning

Disabled.

Maximum number of secure 
MAC addresses per port

1

Violation mode

Shutdown. The port shuts down when the maximum number of 
secure MAC addresses is exceeded.

Port security aging

Disabled. Aging time is 0.

Static aging is disabled.

Type is absolute.