Defining The Maximum Secure Address Count - Cisco Catalyst 2950 Software Configuration Manual

Configuring Port Security
Secured ports generate address-security violations under these conditions:
•
•
Limiting the number of devices that can connect to a secure port has these advantages:
•
•
These options validate port security or show security violations:
Interface
Security
Trap
Shutdown Port
Secure Addresses
Max Addresses
Security Rejects
For the restrictions that apply to secure ports, see the
page
You cannot configure static secure MAC addresses in the voice VLAN.
Note

Defining the Maximum Secure Address Count

A secure port can have from 1 to 132 associated secure addresses. Setting one address in the MAC
address table for the port ensures that the attached device has the full bandwidth of the port.
If the secure-port maximum addresses are set between 1 to 132 addresses and some of the secure
addresses have not been added by user, the remaining addresses are dynamically learnt and become
secure addresses.
Note If the port link goes down, all the dynamically learned addresses are removed.
If you enable port security on a voice VLAN port and if there is a PC connected to the IP phone, you
should set the maximum allowed secure addresses on the port to more than 1.
Catalyst 2950 Desktop Switch Software Configuration Guide
17-4
The address table of a secured port is full, and the address of an incoming packet is not found in the
table.
An incoming packet has a source address assigned as a secure address on another port.
Dedicated bandwidth—If the size of the address table is set to 1, the attached device is guaranteed
the full bandwidth of the port.
Added security—Unknown devices cannot connect to the port.
Port to secure.
Enable port security on the port.
Issue a trap when an address-security violation occurs.
The interface is error-disabled when a security violation occurs.
Note
Number of addresses in the secure address table for this port. Secure ports have
at least one address.
Number of addresses that the secure address table for the port can contain.
Number of unauthorized addresses seen on the port.
26-1.
When a secure port is in the error-disabled state, you can bring it out
of this state by entering the errdisable recovery cause
psecure-violation global configuration command, or you can manually
re-enable it by entering the shutdown and no shut down interface
configuration commands.
"Avoiding Configuration Conflicts" section on
Chapter 17 Configuring Port-Based Traffic Control
78-11380-04