Table of Contents

Understanding How Secure Port Filtering Works
Secure Port Filtering Configuration Guidelines
Configuring Secure Port Filtering

Enabling Secure Port Filtering
Disabling Secure Port Filtering

Configuring Secure Port Filtering

This chapter describes how to configure secure port filtering on the Catalyst 5000, 4000, 2948G, and 2926G series switches.

• Understanding How Secure Port Filtering Works

• Secure Port Filtering Configuration Guidelines

• Configuring Secure Port Filtering

Understanding How Secure Port Filtering Works

You can use secure port filtering to block input to an Ethernet or Fast Ethernet port when the Media Access Control (MAC) address of the station attempting to access the port is different from the MAC address specified for that port.

Secure Port Filtering Configuration Guidelines

These guidelines apply when configuring secure port filtering:

• You cannot configure secure port filtering on a trunk port.

• Secure port filtering is not supported on the three-port Gigabit Ethernet module (WS-X5403).

Configuring Secure Port Filtering

These sections describe how to configure secure port filtering:

• Enabling Secure Port Filtering

• Disabling Secure Port Filtering

Enabling Secure Port Filtering

To enable secure port filtering, perform this task in privileged mode:

Task	Command
Step 1 Enable port security on the desired ports. If desired, specify the secure MAC address.	set port security mod_num/port_num enable [mac_addr]
Step 2 Verify the configuration.	show port [mod_num[/port_num]]

This example shows how to enable secure port filtering on a port using the learned MAC address on a port and verify the configuration:

Console> (enable) set port security 2/1 enable
Port 2/1 port security enabled with the learned mac address.
Trunking disabled for Port 2/1 due to Security Mode
Console> (enable) show port 2/1
Port  Name               Status     Vlan       Level  Duplex Speed Type
----- ------------------ ---------- ---------- ------ ------ ----- ------------
 2/1                     connected  522        normal   half   100 100BaseTX
 
Port  Security Secure-Src-Addr   Last-Src-Addr     Shutdown Trap     IfIndex
----- -------- ----------------- ----------------- -------- -------- -------
 2/1  enabled  00-90-2b-03-34-08 00-90-2b-03-34-08 No       disabled 1081
 
Port     Broadcast-Limit Broadcast-Drop
-------- --------------- --------------
 2/1                   -              0
 
Port  Align-Err  FCS-Err    Xmit-Err   Rcv-Err    UnderSize
----- ---------- ---------- ---------- ---------- ---------
 2/1           0          0          0          0         0
 
Port  Single-Col Multi-Coll Late-Coll  Excess-Col Carri-Sen Runts     Giants
----- ---------- ---------- ---------- ---------- --------- --------- ---------
 2/1           0          0          0          0         0         0         0
 
Last-Time-Cleared
--------------------------
Fri Jul 10 1998, 17:53:38
Console> (enable)
 
 

This example shows how to enable secure port filtering on a port and manually specify the secure MAC address:

Console> (enable) set port security 2/1 enable 00-90-2b-03-34-08
Port 2/1 port security enabled with 00-90-2b-03-34-08 as the secure mac address
Trunking disabled for Port 2/1 due to Security Mode
Console> (enable)

Disabling Secure Port Filtering

To disable secure port filtering, perform this task in privileged mode:

Task	Command
Step 1 Disable port security on the desired ports.	set port security mod_num/port_num disable
Step 2 Verify the configuration.	show port [mod_num[/port_num]]

Console> (enable) set port security 2/1 disable
Port 2/1 port security disabled.
Console> (enable)
 

Posted: Mon Jul 19 12:52:13 PDT 1999
Copyright 1989-1999©Cisco Systems Inc.