port security dynamic mac address learning

PORT SECURITY DYNAMIC MAC ADDRESS LEARNING CODE

An important thing, again, to remember that aging is relevant in situations where the port remains connected. A security violation would ensue if there were already 5 secure MAC addresses in place, and a frame with yet another source MAC address came in, or if some of these 5 secure MAC addresses suddenly appeared as a source MAC of a frame received on a different secure port.Ībout aging - Florian is absolutely correct about the absolute and inactivity aging types. If you have configured a maximum of 5 secure MAC addresses on a port and already added 2 of them statically, another 3 can always be learned dynamically on the fly.

The port does not care about the types of secure MAC addresses. These MAC addresses may either be configured statically, or learned dynamically, or learned dynamically and automatically added to the configuration (sticky). The first task is much more visible and prominent: you have a set of 'allowed' (secure in Cisco parlance) MAC addresses, all other MAC addresses are disallowed on a port. allowing a secure MAC address to be located on a single secure port only.allowing only stations with secure MAC addresses to communicate on a port.

PORT SECURITY DYNAMIC MAC ADDRESS LEARNING CODE

The status code of err-disabled means that the security violation occurred on the port.You have to remember that port security is about Last Source Address:Vlan : 0C3:1īy default, the maximum number of allowed MAC addresses is one, so if we connect another host to the same port, the security violation will occur: SW1#show interfaces fastEthernet0/1įastEthernet0/1 is down, line protocol is down (err-disabled) Next, by using the show port-security interface fa0/1 we can see that the switch has learned the MAC address of host A: SW1#show port-security interface fastEthernet0/1 SW1(config-if)#switchport port-security mac-address sticky The following example shows the configuration of port security on a Cisco switch:įirst, we need to enable port security and define which MAC addresses are allowed to send frames: SW1(config)#interface fastEthernet0/1 define the maximum number of MAC addresses that can be used on the port by using the switchport port-security maximum NUMBER interface submode command Shut down mode also shuts down the port.Ģ. The restrict and shutdown options send log messages when a violation occurs. All three options discard the traffic from the unauthorized device. define what action the switch will take when receiving a frame from an unauthorized device by using the port security violation interface subcommand. define which MAC addresses are allowed to send frames through this interface by using the switchport port-security mac-address MAC_ADDRESS interface subcommand or using the swichport port-security mac-address sticky interface subcommand to dynamically learn the MAC address of the currently connected hostġ.

enable port security by using the switchport port-security interface subcommandģ. define the interface as an access interface by using the switchport mode access interface subcommandĢ. To configure port security, three steps are required:ġ.

If an unauthorized device is connected, you can decide what action the switch will take, for example discarding the traffic and shutting down the port. This way you can restrict access to an interface so that only the authorized devices can use it. By using port security, a network administrator can associate specific MAC addresses with the interface, which can prevent an attacker to connect his device. If you know which devices will be connected to which ports, you can use the Cisco security feature called port security. That means that an attacker could connect to your network through a wall socket and potentially threaten your network. By default, all interfaces on a Cisco switch are turned on.

Port security dynamic mac address learning