Cisco :: Port Security

Buat cengginie ::

Switch)# config t
Switch(config)# int fa0/18
Switch(config-if)# switchport port-security ?
 aging           Port-security aging commands
 mac-address     Secure mac address
 maximum         Max secure addresses
 violation       Security violation mode


Switch(config-if)# switchport port-security
Switch(config-if)#^Z

As you can see in the example, there are a number of other port security commands that you can configure. Here are some of your options:

• switchport port-security maximum {max # of MAC addresses allowed}: You can use this option to allow more than the default number of MAC addresses, which is one. For example, if you had a 12-port hub connected to this switch port, you would want to allow 12 MAC addresses—one for each device. The maximum number of secure MAC addresses per port is 132.
• switchport port-security violation {shutdown | restrict | protect}: This command tells the switch what to do when the number of MAC addresses on the port has exceeded the maximum. The default is to shut down the port. However, you can also choose to alert the network administrator (i.e., restrict) or only allow traffic from the secure port and drop packets from other MAC addresses (i.e., protect).
• switchport port-security mac-address {MAC address}: You can use this option to manually define the MAC address allowed for this port rather than letting the port dynamically determine the MAC address.

These are the guidelines to configure port security:

	A secure port cannot be a trunk port.
	A secure port cannot be an 802.1X port.
	A secure port cannot belong to an EtherChannel port-channel interface.
	A secure port and static MAC address configuration are mutually exclusive.
	A secure port cannot be a destination port for Switch Port Analyzer (SPAN).

Reference ::
http://www.techrepublic.com/article/lock-down-cisco-switch-port-security/6123047
http://www.networkworld.com/community/node/25359
http://www.cisco.com/en/US/products/hw/switches/ps5023/products_configuration_example09186a00807c4101.shtml#diag