Protect - drops the frames from the unauthorized device Identifies the action the switch will take when an authorized device attempts to use the port.

Switch(config-if)# switchport port-security violation (protect |restrict | shutdown) This interface will accept the first MAC address it receives and sends it to the running-config file.Ĭhooses which interface to configure a violation on With this command, learned addresses are added to the running-config file. Without this command, addresses are dynamically learned, but NOT recorded. Switch(config)# switchport port-security mac-address stickyĮnables sticky learning of MAC addresses. Identifies an allowed address making it sticky address.Ĭhooses which interface to make a dynamic port security on Switch(config-if)#switchport port-security mac-address sticky _ Switch(config-if)#switchport port-security mac-address _ Go to the interface that needs to have port securityĬhooses which interface to make a static port security on If you enable the sticky feature, all SecureDynamic addresses are converted to SecureSticky addresses, even if they have been learned before the sticky feature was enabled. If you disable the sticky feature, all sticky addresses are converted to SecureDynamic addresses.ģ. You can manually configure an address and identify it as a sticky addressĢ. The MAC address is automatically entered into the running config file as a sticky addressġ. SecureSticky: A SecureSticky is a MAC address that is manually configured or dynamically learned and saved. SecureDynamic addresses are only saved in MAC address table in RAM and are not added to the config file If the maximum number of allowed devices has not been reached, its MAC address is added to the table, and use of the port is allowed.ģ. When a device connects to the switch port, its MAC address is identified.Ģ. SecureDynamic: A SecureDynamic address is a MAC address that has been dynamically learned and allowed by the switch:ġ. The address is configured in interface mode and stored in the running config file. MAC address table showing 'Drop' port for learned address in VLAN 835ĬLBdg640Test-AS2960-0#sh mac address-table address : A SecureConfigured address is a MAC address that has been manually identified as an allowed address. PD device, Power source: PSE, Power Priority: High, Wattage: 6.5 Network Policy(Voice): VLAN 835, tagged, Layer-2 priority: 5, DSCP: 46 (PS) Power Source Entity, (PD) Power Device (NP) Network Policy, (LI) Location Identification Media Attachment Unit type - not advertised LLDP neighbor info showing voice vlan 835ĬLBdg640Test-AS2960-0#sh lldp neighbors fa0/1 detail Operational Trunking Encapsulation: nativeĪdministrative Native VLAN tagging: enabledĪdministrative private-vlan host-association: noneĪdministrative private-vlan mapping: noneĪdministrative private-vlan trunk native VLAN: noneĪdministrative private-vlan trunk Native VLAN tagging: enabledĪdministrative private-vlan trunk encapsulation: dot1qĪdministrative private-vlan trunk normal VLANs: noneĪdministrative private-vlan trunk associations: noneĪdministrative private-vlan trunk mappings: none Resulting Switchport config - voice vlan is 835ĬLBdg640Test-AS2960-0#show int fa0/1 switchportĪdministrative Trunking Encapsulation: dot1q Can anyone suggest why this is happening? There is no static mac address table blocking configured on the switch. I can see the MAC address of the phone is learned in the right VLANs, but the mac address is showing as 'Drop', which normally means the address is statically configured to be blocked. However, I then see no traffic from the phone on the switch. On connecting the phone, I get the port authenticated and assigned to the correct VLAN, with LLDP-MED advertising the correct voice vlan. I am configuring a Cat 2960 port for connecting a VOIP phone, authenticated by MAB.

Cisco mac address timeoutswitch port