Verifying Port Security

When port security is enabled, the administrator should use show commands to verify that the port learned the MAC address. Additionally, show commands are useful when monitoring and troubleshooting port-security configurations. They can be used to view information such as the maximum number of MAC addresses that can be associated with a port, the violation count, and the current violation mode.

Use the show port-security command to view port security settings for the switch, including violation count, configured interfaces, and security violation actions.

Use the show port-security [interface interface-id] command to view port security settings for the specified interface, including the maximum allowed number of secure MAC addresses for the interface, the number of secure MAC addresses on the interface, the number of security violations that have occurred, and the violation mode.

Use the show port-security [interface interface-id] address command to view all secure MAC addresses configured on all switch interfaces or on a specified interface with aging information for each address.

Network managers need a way of monitoring who is using the network and where they are. For example, if port F2/1 is secure on a switch, an SNMP trap is generated when a MAC address entry for that port disappears from the MAC address table.

The MAC address notification feature sends SNMP traps to the network management station (NMS) whenever a new MAC address is added to or an old address is deleted from the forwarding tables. MAC address notifications are generated only for dynamic and secure MAC addresses.

MAC address notification allows the network administrator to monitor MAC addresses that are learned as well as MAC addresses that age out and are removed from the switch.

Use the mac address-table notification global configuration command to enable the MAC address notification feature on a switch.

biOos