11.1. Port Security Commands

Command Purpose

Use this command to clear static port-security mac address table.

Prerequisites

Command Syntax

clear port-security address-table static ( interface IFNAME | vlan VLAN_ID | address MAC_ADDR | )

Command Mode

Privileged EXEC

Default

None

Usage

None

Examples

This example shows how to clear all static port-security mac address-table:

Switch# clear port-security address-table static

This example shows how to clear static port-security mac address-table on eth-0-1:

Switch# clear port-security address-table static interface eth-0-1

Related Commands

show mac address-table

Command Purpose

To enable port security on an interface, use the switchport port-security command. To disable port security, use the no switchport port-security command.

Prerequisites

Command Syntax

switchport port-security

no switchport port-security

Command Mode

Interface Configuration

Default

Disabled

Usage

When disable port-security, all the port-security mac address entries which are learnt dynamically will be cleared. The static port-security mac address will be ineffective but not be cleared

Examples

This example shows how to enable port security on an interface:

Switch# configure terminal
Switch(config)# interface eth-0-1
Switch(config-if)# switchport port-security

This example shows how to disable port security on an interface:

Switch# configure terminal
Switch(config)# interface eth-0-1
Switch(config-if)# no switchport port-security

Related Commands

show port-security interface

Command Purpose

Use this command to add static port-security mac address.

Prerequisites

Command Syntax

switchport port-security mac-address MAC_ADDR vlan VLAN_ID

no switchport port-security mac-address MAC_ADDR vlan VLAN_ID

Command Mode

Interface Configuration

Default

None

Usage

None

Examples

This example shows how to configure static port-security mac address:

Switch# configure terminal
Switch(config)# interface eth-0-1
Switch(config-if)# switchport port-security mac-address 0.0.1 vlan 1

This example shows how to delete static port-security mac address:

Switch# configure terminal
Switch(config)# interface eth-0-1
Switch(config-if)# no switchport port-security mac-address 0.0.1 vlan 1

Related Commands

show mac address-table

Command Purpose

Use this command to set the maximum of secure dynamic MAC addresses on a port. Use the no switchport port-security maximum command to return to the default settings.

Prerequisites

Command Syntax

switchport port-security maximum MAXIMUM

no switchport port-security maximum

Command Mode

Interface Configuration

Default

1

Usage

If the new maximum is smaller than the current secure addresses on the interface, the configuration is rejected.

Once the secure dynamic MAC address number on the port reached the maximum number, no more address can be learnt on that port.

The maximum number 0 indicates that no dynamic secure MAC is allowed, only static secure MAC is supported.

Examples

This example sets the maximum number of secure dynamic MAC addresses on a port:

Switch# configure terminal
Switch(config)# interface eth-0-1
Switch(config-if)# switchport port-security maximum 1024

This example restores the maximum number of secure dynamic MAC addresses on a port to default value:

Switch# configure terminal
Switch(config)# interface eth-0-1
Switch(config-if)# no switchport port-security maximum

Related Commands

switchport port-security violation

show port-security maximum mac-num interface IFNAME

Command Purpose

Use this command to set the action to be taken when a security violation is detected. Use the no switchport port-security violation command to return to the default settings.

Prerequisites

Command Syntax

switchport port-security violation ( protect | restrict | errdisable )

no switchport port-security violation

Command Mode

Interface Configuration

Default

Discard packet silently

Usage

To use this command, enable switchport port-security first

Examples

This example sets port-security violation to discard packets silently:

Switch# configure terminal
Switch(config)# interface eth-0-1
Switch(config-if)# switch port-security violation protect

Related Commands

switchport port-security

Command Purpose

Use this command to show port-security mac address-table.

Prerequisites

Command Syntax

show port-security address-table ( static | dynamic | ) ( interface IFNAME | vlan VLAN_ID | address MAC_ADDR | )

Command Mode

Privileged EXEC

Default

None

Usage

None

Examples

This example shows port-security mac address-table on the Switch:

Switch# show port-security address-table

          Secure Mac Address Table
----------------------------------------------------------------------
Vlan    Mac Address                          Type                        Ports
----    ---------------------    -----------------------      -----------
1      0058.3fce.ef01                 SecureConfigured              eth-0-11
41     0058.3f2c.a1dc                 SecureConfigured              eth-0-41

Related Commands

None

Command Purpose

Use this command to show current port-security MAC number on interface.

Prerequisites

Command Syntax

show port-security current mac-num interface IFNAME

Command Mode

Privileged EXEC

Default

None

Usage

None

Examples

This example shows current port-security mac-num on interface eth-0-1:

Switch# show port-security current mac-num interface eth-0-1

Current dynamic MAC addresses : 0
Current static MAC addresses  : 0
Current total MAC addresses   : 0

Related Commands

switchport port-security maximum

show port-security maximum mac-num interface interface

Command Purpose

Use this command to show the port-security information on an interface.

Prerequisites

Command Syntax

show port-security interface IFNAME

Command Mode

Privileged EXEC

Default

None

Usage

None

Examples

This example shows the port-security information on interface eth-0-1:

Switch# show port-security interface eth-0-1

Port Security               : disabled
Violation mode              : discard packet silence
Maximum MAC Addresses       : 1
Total MAC Addresses             : 1
Static configured MAC Addresses ：1

Related Commands

None

Command Purpose

Use this command to show the port-security maximum MAC number on an interface.

Prerequisites

Command Syntax

show port-security maximum mac-num interface IFNAME

Command Mode

Privileged EXEC

Default

None

Usage

None

Examples

This example shows the port-security maximum mac-num on interface eth-0-1:

Switch# show port-security maximum mac-num interface eth-0-1

Maximum dynamic MAC addresses : 1

Related Commands

switchport port-security maximum

show port-security current mac-num interface