Content

| 9.6 |  | Securing User Access |
| 9.6.7 |  | Configuring and verifying port security |

Follow these guidelines when configuring port security:

- A protected port cannot be a routed port.
- A secure port cannot be a dynamic access port or a trunk port.
- A protected port cannot be a secure port.
- A secure port cannot be a destination port for Switch Port Analyzer (SPAN).
- A secure port cannot belong to a Fast EtherChannel or Gigabit EtherChannel port group.
- A secure port cannot be an 802.1X port. Attempting to enable 802.1X on a secure port will result in an error message, and 802.1X will not be enabled. Attempting to change an 802.1X-enabled port to a secure port will also result in an error message, and the security settings will not be changed.

Beginning in privileged EXEC mode, follow the steps in Figure to restrict input to an interface using port security.

To return the interface to the default condition (a non-secure port), use the no switchport port-security interface configuration command.

To return the interface to the default number of secure MAC addresses (128), use the no switchport port-security maximum maximum-number-of-addresses interface configuration command.

To delete a MAC address from the address table, use the no switchport port-security mac-address mac_address command.

To return the violation mode to the default condition (shutdown mode), use the no switchport port-security violation {protect | restrict} command.

To display traffic control information, use one or more of the privileged EXEC commands in Figure .

The show interfaces interface-id switchport privileged EXEC command displays the interface traffic suppression and control configuration. The show interfaces counters privileged EXEC command displays the count of discarded packets. The show storm control and show port-security privileged EXEC commands display those features.

| Interactive Media Activity Drag and Drop: Catalyst Port Security After completing this activity, the students will be able to understand Catalyst port security.