This is an old revision of the document!
Staticke adresy jsou ulozene v address-table a v running-configu (lze je tedy ulozit)
Switch(config)# interface fastethernet 0/0
Switch(config-if)# switchport mode access
Switch(config-if)# switchport port-security mac-address [mac-address]
Dynamicke adresy si switch zjisti sam, adresy jsou ulozene jen v address-table, po restartu switche nebo spadnuti portu se vsak smazou
Switch(config)# interface fastethernet 0/0
Switch(config-if)# switchport mode access
Switch(config-if)# switchport port-security
To same jako Dynamic, jen jsou zaroven v running-configu, lze je tedy ulozit
Switch(config)# interface fastethernet 0/0
Switch(config-if)# switchport mode access
Switch(config-if)# switchport port-security maximum 50
Switch(config-if)# switchport port-security mac-address sticky
Switch# show port security interface fastethernet 0/0
Switch# show port security address
Switch# clear port-security sticky interface [port-number] access
Switch(config-if)# shutdown
Switch(config-if)# no shutdown
nebo
Switch(config-if)# no switchport port-security
Switch(config-if)# switchport port-security
nebo
Switch# reload
Nastavení události při zjištění nepovolené MAC:
Příklad Syslog zprávy:
Jun 3 17:18:41.888 EDT: %PORT_SECURITY-2-PSECURE_VIOLATION: Security violation occurred, caused by MAC address 0000.5e00.0101 on port GigabitEthernet0/11.
Switch# show port-security interface gigabitethernet 0/11
Switch# show port-security interface gigabitethernet 0/11 Port Security : Enabled Port Status : Secure-shutdown Violation Mode : Shutdown Aging Time : 0 mins Aging Type : Absolute SecureStatic Address Aging : Disabled Maximum MAC Addresses : 1 Total MAC Addresses : 0 Configured MAC Addresses : 0 Sticky MAC Addresses : 0 Last Source Address : 0003.a089.efc5 Security Violation Count : 1 Switch#
Switch# show interfaces status err-disabled
Switch# show interfaces status err-disabled Port Name Status Reason Gi0/11 Test port err-disabled psecure-violation Switch# TIP When a port is moved to the errdisable state, you must either manually cycle it or configure the switch to automatically re-enable ports after a prescribed delay. To manually cycle a port and return it to service, use the following commands: Switch(config)# interface Gi 0/11 Switch(config-if)# shutdown Switch(config-if)# no shutdown
Switch# show port-security
Switch# show port-security Secure Port MaxSecureAddr CurrentAddr SecurityViolation Security Action (Count) (Count) (Count) --------------------------------------------------------------------------- Gi0/11 5 1 0 Restrict Gi0/12 1 0 0 Shutdown --------------------------------------------------------------------------- Total Addresses in System (excluding one mac per port) : 0 Max Addresses limit in System (excluding one mac per port) : 6176 Switch#