11.24. Port-block Commands

11.24.1. port-block

Command Purpose

To configure port block, use the port-block command in interface configuration mode. To delete this configuration, use the no form of this command.

Prerequisites

Platform

Software

License

Comments

AQ-N3000

7.0

Base

AQ-N5000

7.0

Base

AQ-N6000

7.0

Base

Command Syntax

port-block ( known-unicast | known-multicast | unknown-unicast | unknown-multicast | broadcast )

no port-block ( known-unicast | known-multicast | unknown-unicast | unknown-multicast | broadcast )

Parameter

Parameter Description

Parameter Value

known-unicast

Specify that known unicast traffic should be blocked

-

known-multicast

Specify that known multicast traffic should be blocked

-

unknown-unicast

Specify that unknown unicast traffic should be blocked

-

unknown-multicast

Specify that unknown multicast traffic should be blocked

-

broadcast

Specify that broadcast traffic should be blocked

-

Command Mode

Interface Configuration

Default

Unknown or known multicast and unicast traffic is not blocked.

Broadcast traffic is not blocked.

Usage

By default, all traffic with unknown MAC addresses is sent to all ports. You can block unknown multicast or unicast traffic on protected or non protected ports. If unknown multicast or unicast traffic is not blocked on a protected port, there could be security issues.

With multicast traffic, the port blocking feature blocks only pure Layer 2 packets. Multicast packets that contain IPv4 or IPv6 information in the header are not blocked.

Examples

This example shows how to block unknown multicast traffic on an interface:

Switch# configure terminal
Switch(config)# interface eth-0-1
Switch(config-if)# port-block known-unicast

11.24.2. show port-block

Command Purpose

Use this command to display the port-block configuration.

Prerequisites

Platform

Software

License

Comments

AQ-N3000

7.0

Base

AQ-N5000

7.0

Base

AQ-N6000

7.0

Base

Command Syntax

show port-block ( interface IFNAME | )

Parameter

Parameter Description

Parameter Value

IFNAME

Specify the interface

Support physical/aggregationports

Command Mode

Privileged EXEC

Default

N/A

Usage

If the interface is not specified, all interfaces should be displayed.

Examples

This example shows how to show port-block configuration in Privileged EXEC:

Switch# show port-block interface eth-0-1

Related Commands

port-block (known-unicast | known-multicast | unknown-unicast | unknown-multicast | broadcast)