Content

| 9.6 |  | Securing User Access |
| 9.6.2 |  | Using port security, protected ports, and private VLANs |

Port security is an IOS feature available on the 6500 series, 3550 series, and 2950 series of Catalyst switches. The port security feature can be used to restrict input to an interface by limiting and identifying MAC addresses of the stations allowed access to the port. When secure MAC addresses are assigned to a secure port, the port does not forward packets with source addresses outside the group of defined addresses. By limiting the number of secure MAC addresses to one and assigning a single secure MAC address to the port, the workstation attached to that port is assured the full bandwidth of the port.

If a port is configured as a secure port and the maximum number of secure MAC addresses is reached, when an additional station attempts to access the port, a security violation is logged. Also, if a station with a secure MAC address configured or learned on one secure port attempts to access a different secure port, a violation is flagged.

Operation of Port Security
After the maximum number of secure MAC addresses on a port, the range is 1 to 128 with a default of 128 has been configured, the secure addresses are included in an address table in one of the following ways:

- Manually configure all secure MAC addresses by using the switchport port-security mac-address mac_address interface configuration command.
- Allow the port to dynamically configure secure MAC addresses with the MAC addresses of connected devices.
- Manually configure a number of addresses and allow the rest to be dynamically configured.

> Note: If a port shuts down, all dynamically learned addresses for that port are removed.

Once the maximum number of secure MAC addresses is configured, the addresses are stored in an address table. Setting the maximum number of addresses to one and configuring the MAC address of an attached device ensures that the device has the full bandwidth of the port.

Port Security Violations
A security violation occurs in these situations:

- The maximum number of secure MAC addresses has been added to the address table and a station whose MAC address is not in the address table attempts to access the interface.
- A station whose MAC address is configured as secure on another secure port attempts to access the interface.

The interface can be configured for one of three violation modes, based on the action to be taken if a violation occurs:

- Protect – when the number of secure MAC addresses reaches the maximum limit allowed on the port, packets with unknown source addresses are dropped until secure MAC addresses are manually removed from the port's address table to create a free slot.
- Restrict – a port security violation causes a trap notification to be sent to the SNMP network management station.
- Shutdown – a port security violation causes the interface to shut down immediately and send an SNMP trap notification. Once shut down, the interface must be manually re-enabled by using the no shutdown interface configuration command. This is the default mode.

By default, port security is disabled on a port. Port security defaults are a maximum of 128 secure MAC addresses per port, and shutdown on security violation.

Protected Ports
Protected ports do not forward any traffic to other protected ports on the same switch. This means that all traffic passing between protected ports – unicast, broadcast, and multicast – must be forwarded through a Layer 3 device. Protected ports can forward any type of traffic to nonprotected ports, and they forward as usual to all ports on other switches.

This functionality is available on the Catalyst 2950 series and 3550 series switches. The Catalyst 6500 series switch uses a technology called private VLANs. Although protected ports and private VLANs are conceptually the same, configuring private VLANs on the 6500 series switch is significantly different from configuring protected ports on the 2950 series and 3550 series switches.

This section covers the configuration of protected ports on 2950 series and 3550 series switches. Please refer to CCO for information on configuring private VLANs on 6500 series switches.

Protected ports provide Layer 2 isolation between ports within the same VLAN, and have two common features:

- A protected port does not forward any traffic, unicast, multicast, or broadcast to any other port that is also a protected port. Traffic cannot be forwarded between protected ports at Layer 2. All traffic passing between protected ports must be forwarded through a Layer 3 device.
- Forwarding behavior between a protected port and a nonprotected port will proceed as usual.

The factory default is that no protected ports are configured.

There could be times when unknown unicast or multicast traffic from a nonprotected port is flooded to a protected port because a MAC address has timed out or has not been learned by the switch. Using the commands switchport block unicast and switchport block multicast will guarantee that no unicast and multicast traffic is flooded to the port under these conditions.