Port Security

Configure switchport port-security to limit MAC addresses on access ports and compare the protect, restrict, and shutdown violation modes.

Switch(config-if)#switchport port-security
Command rejected: FastEthernet3/0/1 is a dynamic port.
Switch(config-if)#switchport mode access
Switch(config-if)#switchport port-security
Switch(config-if)#switchport port-security mac-address ?
  H.H.H   48 bit mac address
  sticky  Configure dynamic secure addresses as sticky
Switch(config-if)#switchport port-security violation ?
  protect   Security violation protect mode
  restrict  Security violation restrict mode
  shutdown  Security violation shutdown mode

• protect: Drops packets with unknown source addresses
• restrict: Drops packets with unknown source addresses + produce a log + increment SecurityViolation counter
• shutdown: Puts the interface into the error-disabled state immediately and sends an SNMP trap notification.

Switch#show port-security
Secure Port  MaxSecureAddr  CurrentAddr  SecurityViolation  Security Action
                (Count)       (Count)          (Count)
---------------------------------------------------------------------------
    Fa3/0/1              1            0                  0         Shutdown
---------------------------------------------------------------------------
Total Addresses in System (excluding one mac per port)     : 0
Max Addresses limit in System (excluding one mac per port) : 6144

Switch#show interfaces status err-disabled