Cisco Systems WSC4500X16SFP Manual De Usuario
30-4
Software Configuration Guide—Release 12.2(25)EWA
OL-6850-03
Chapter 30 Configuring Port Security and Trunk Port Security
Configuring Port Security
•
A secure port and static MAC address configuration for an interface are mutually exclusive.
•
Port security cannot be enabled on dynamic access ports.
•
Port security cannot be enabled on Ether Channels.
•
When you enable port security on an interface that is also configured with a voice VLAN, you must
set the maximum allowed secure addresses on the port to two plus the maximum number of secure
addresses allowed on the access VLAN. When the port is connected to a Cisco IP phone, the IP
phone requires up to two MAC addresses. The IP phone address is learned on the voice VLAN and
might also be learned on the access VLAN. Connecting a PC to the IP phone requires additional
MAC addresses.
set the maximum allowed secure addresses on the port to two plus the maximum number of secure
addresses allowed on the access VLAN. When the port is connected to a Cisco IP phone, the IP
phone requires up to two MAC addresses. The IP phone address is learned on the voice VLAN and
might also be learned on the access VLAN. Connecting a PC to the IP phone requires additional
MAC addresses.
•
When you enter a maximum secure address value for an interface, and the new value is greater than
the previous value, the new value overwrites the previously configured value. If the new value is less
than the previous value and the number of configured secure addresses on the interface exceeds the
new value, the command is rejected.
the previous value, the new value overwrites the previously configured value. If the new value is less
than the previous value and the number of configured secure addresses on the interface exceeds the
new value, the command is rejected.
•
The switch does not support port security aging of sticky secure MAC addresses.
Configuring Port Security
These sections describe how to configure port security:
•
•
•
Configuring Port Security on an Interface
To restrict traffic through a port by limiting and identifying MAC addresses of the stations allowed to
the port, perform this task:
the port, perform this task:
Command
Purpose
Step 1
Switch(config)# interface
interface_id
Enters interface configuration mode and specifies the
physical interface to configure.
physical interface to configure.
Step 2
Switch(config-if)# switchport mode {access |
private vlan host
| private vlan promiscuous}
Sets the interface mode.
Note
An interface in the default mode (dynamic
desirable) cannot be configured as a secure port.
desirable) cannot be configured as a secure port.
Step 3
Switch(config-if)# switchport port-security
Enables port security on the interface.
Step 4
Switch(config-if)# switchport port-security
maximum
value
(Optional) Sets the maximum number of secure MAC
addresses for the interface. The range is 1 to 3072; the
default is 1.
addresses for the interface. The range is 1 to 3072; the
default is 1.