1 of 11

Port Security

A

up

down

B

errdisable

S(config)# interface fa0/1

S(config-if)# switchport mode access

//mode trunk or acccess, not for dynamic port

S(config-if)# switchport port-security

S(config-if)# switchport port-security maximum 1

S(config-if)# switchport port-security mac-address 0000.0001.000A

S(config-if)# switchport port-security violation shutdown

Administrative down

2 of 11

Port Security

A

up

B

S(config)# interface fa0/1

S(config-if)# switchport mode access

S(config-if)# switchport port-security

S(config-if)# switchport port-security maximum 2

S(config-if)# switchport port-security mac-address 0000.0001.000A

S(config-if)# switchport port-security mac-address 0000.0001.000B

S(config-if)# switchport port-security violation shutdown

3 of 11

Port Security

A

up

B

S(config)# interface fa0/1

S(config-if)# switchport mode access

S(config-if)# switchport port-security

S(config-if)# switchport port-security maximum 2

S(config-if)# switchport port-security mac-address 0000.0001.000A

S(config-if)# switchport port-security mac-address 0000.0001.000B

S(config-if)# switchport port-security violation shutdown

C

4 of 11

Port Security

A

up

B

S(config)# interface fa0/1

S(config-if)# switchport mode access

S(config-if)# switchport port-security

S(config-if)# switchport port-security maximum 2

S(config-if)# switchport port-security mac-address sticky

S(config-if)# switchport port-security violation shutdown

Switch tự động học n MAC đầu tiên bằng cách cắm lần lượt n PC, rồi ping từ PC

5 of 11

Port Security

A

up

B

S(config)# interface fa0/1

S(config-if)# switchport mode access

S(config-if)# switchport port-security

S(config-if)# switchport port-security maximum 2

S(config-if)# switchport port-security mac-address 0000.0001.000A

S(config-if)# switchport port-security mac-address sticky

S(config-if)# switchport port-security violation shutdown

Switch tự động học n MAC đầu tiên bằng cách cắm lần lượt n PC, rồi ping từ PC

6 of 11

Port Security

A

up

B

S(config)# interface fa0/1

S(config-if)# switchport mode access

S(config-if)# switchport port-security

S(config-if)# switchport port-security maximum 1

S(config-if)# switchport port-security mac-address 0000.0001.000A

S(config-if)# switchport port-security violation shutdown

default violation is shutdown

down

7 of 11

Port Security

up

S(config)# interface fa0/1

S(config-if)# switchport mode access

S(config-if)# switchport port-security

S(config-if)# switchport port-security maximum 1

S(config-if)# switchport port-security mac-address 0000.0001.000A

S(config-if)# switchport port-security violation restrict

drop frame, phát syslog

A

B

Packet

B

C

%PORT_SECURITY-2-PSECURE_VIOLATION: Security violation occurred, caused by MAC address 4000.7e06.fd43 on port FastEthernet0/1.

show logging

8 of 11

Port Security

up

S(config)# interface fa0/1

S(config-if)# switchport mode access

S(config-if)# switchport port-security

S(config-if)# switchport port-security maximum 1

S(config-if)# switchport port-security mac-address 0000.0001.000A

S(config-if)# switchport port-security violation protect

drop frame, no syslog

A

B

Packet

B

C

%PORT_SECURITY-2-PSECURE_VIOLATION: Security violation occurred, caused by MAC address 4000.7e06.fd43 on port FastEthernet0/1.

9 of 11

Recovery Port Security

up

S(config)# interface fa0/1

S(config-if)# shutdown

S(config-if)# no shutdown

down

A

B

SW1# show interface status err-disabled

Port Name Status Reason Err-disabled Vlans

Fa0/2 err-disabled port-security

10 of 11

Verifying Port Security

SwitchX# show port-security interface f0/5

Port Security              : Enabled

Port Status                : Secure-up

Violation Mode             : Shutdown

Aging Time                 : 20 mins

Aging Type                 : Absolute

SecureStatic Address Aging : Disabled

Maximum MAC Addresses      : 1

Total MAC Addresses        : 1

Configured MAC Addresses   : 0

Sticky MAC Addresses       : 0

Last Source Address        : 0000.0000.0000

Security Violation Count   : 0

11 of 11

Verifying Port Security

SwitchX# show port-security address

​

Secure Mac Address Table

-----------------------------------------------------------------

Vlan Mac Address Type Ports Remaining Age

(mins)

---- ----------- ---- ----- -------------

1 0008.dddd.eeee SecureConfigured Fa0/5 -

-----------------------------------------------------------------

Total Addresses in System (excluding one mac per port) : 0

Max Addresses limit in System (excluding one mac per port) : 1024