User Tools
cisco:certification_topics:ccie-ei:1.1.aii
Differences
This shows you the differences between two versions of the page.
| Both sides previous revisionPrevious revisionNext revision | Previous revision | ||
| cisco:certification_topics:ccie-ei:1.1.aii [2025/11/23 15:10] – Name | cisco:certification_topics:ccie-ei:1.1.aii [2025/11/23 17:11] (current) – Name | ||
|---|---|---|---|
| Line 2: | Line 2: | ||
| =====Port Security===== | =====Port Security===== | ||
| + | ====General==== | ||
| + | * Port security configuration on the whole switch can be viewed by. | ||
| + | * < | ||
| + | Secure Port MaxSecureAddr | ||
| + | (Count) | ||
| + | --------------------------------------------------------------------------- | ||
| + | Te1/ | ||
| + | --------------------------------------------------------------------------- | ||
| + | Total Addresses in System (excluding one mac per port) : 0 | ||
| + | Max Addresses limit in System (excluding one mac per port) : 4096</ | ||
| * Port security configuration on a port can be viewed by. | * Port security configuration on a port can be viewed by. | ||
| * < | * < | ||
| Line 16: | Line 26: | ||
| Last Source Address: | Last Source Address: | ||
| Security Violation Count : 0</ | Security Violation Count : 0</ | ||
| + | ====Administrative Mode==== | ||
| + | * The Administrative Mode **static access** or **trunk** to enable port-security on a port. | ||
| + | * < | ||
| + | Name: Te1/0/1 | ||
| + | Switchport: Enabled | ||
| + | Administrative Mode: static access | ||
| + | |||
| + | switch(config)# | ||
| + | switch(config-if)# | ||
| + | * < | ||
| + | Name: Te1/0/3 | ||
| + | Switchport: Enabled | ||
| + | Administrative Mode: trunk | ||
| + | |||
| + | switch(config)# | ||
| + | switch(config-if)# | ||
| + | * The default of **dynamic auto** will result in a rejected **switchport port-security** command. | ||
| + | * < | ||
| + | Name: Te1/0/2 | ||
| + | Switchport: Enabled | ||
| + | Administrative Mode: dynamic auto | ||
| + | |||
| + | switch(config-if)# | ||
| + | Command rejected: TenGigabitEthernet1/ | ||
| + | ====Aging Time==== | ||
| * By default, secure MAC addresses will not age out. | * By default, secure MAC addresses will not age out. | ||
| * To define an aging time, from 1-1440 minutes | * To define an aging time, from 1-1440 minutes | ||
| - | * < | + | * < |
| - | * The default aging type is Abosolute | + | < |
| - | * < | + | ====Aging Types==== |
| - | Aging Time : 1 mins</ | + | |
| + | * Absolute | ||
| + | | ||
| + | * After the secure MAC address is learned, the aging timer starts and the MAC is removed after the timer expires, even if the switch continues receiving frames from that source MAC address. | ||
| + | | ||
| + | * After the secure MAC address is learned, the aging timer starts but is reset every time a frame from that source MAC address is received on the interface. | ||
| + | * Can be configured by. | ||
| + | | ||
| + | absolute | ||
| + | inactivity | ||
| + | |||
| + | ====Secure MAC aging==== | ||
| + | * Secure Static MAC aging is disabled by default (addresses configured with **switchport port-security mac-address** < | ||
| + | * Can be enabled by. | ||
| + | * < | ||
| + | ====Violation Modes==== | ||
| + | * Determines how port-security will protect the port in case of a violation. | ||
| + | * The modes are: | ||
| + | * protect | ||
| + | * Discard traffic from unauthorized hosts. | ||
| + | * The interface will remain up if more than the maximum number of addresses is learned, but traffic violating devices are dropped and no log entry is generated. | ||
| + | * Keyword: No log entry. | ||
| + | * restrict | ||
| + | * The interface will remain up if more than the maximum number of addresses is learned, but traffic violating devices is dropped and a log entry is generated. | ||
| + | * shutdown | ||
| + | * Shutdowns the port if more than the maximum number of allowable MAC addresses are learned on the interface. | ||
| + | * Defined per port by. | ||
| + | * < | ||
| + | protect | ||
| + | restrict | ||
| + | shutdown | ||
| + | |||
| + | =====Sticky MAC addresses===== | ||
| + | ====General==== | ||
| + | * There are two type of sticky secure MAC address. | ||
| + | - An incoming packet, with a MAC address, is automatically assigned to that port. | ||
| + | - The MAC address is statically defined. | ||
| + | * By default, when enabled, one MAC address is allowed per port. | ||
| + | * Sticky secure MAC address learning can be enabled, per interface, by. | ||
| + | * < | ||
| + | H.H.H 48 bit mac address | ||
| + | < | ||
| + | * < | ||
| + | * Sticky secure MAC address will never age out. | ||
| + | * If the command, **switchport port-security mac-address sticky** is issued, then all current dynamically-learned secure MAC addresses will be converted to sticky secure MAC addresses. | ||
| + | * Sticky secure MAC address learning can be disabled by. | ||
| + | * < | ||
| + | * All current sticky secure MAC addresses will be converted to regular dynamically-learned secure MAC address. | ||
| + | ====Types==== | ||
| + | * Secure MAC addresses will be added to the MAC address table like any other MAC address. | ||
| + | * Sticky and Static secure MAC addresses will have a type of STATIC. | ||
| + | * Dynamically-learned secure MAC addresses will have a type of DYNAMIC. | ||
| + | * To view all secure MAC addresses. | ||
| + | * < | ||
| + | Mac Address Table | ||
| + | ------------------------------------------- | ||
| + | |||
| + | Vlan Mac Address | ||
| + | ---- ----------- | ||
| =====Errdisable recovery===== | =====Errdisable recovery===== | ||
| Line 67: | Line 161: | ||
| ====Configuration===== | ====Configuration===== | ||
| - | * To configure all causes | + | |
| + | | ||
| * < | * < | ||
| - | * To configure one cause | + | * To configure one cause. |
| * < | * < | ||
| * < | * < | ||
| - | * To disable all causes | + | * To disable all causes. |
| * < | * < | ||
| - | * To disable one cause | + | * To disable one cause. |
| * < | * < | ||
| * < | * < | ||
| ====Recovery Options===== | ====Recovery Options===== | ||
| - | * Automatically recover from all error conditions | + | * Automatically recover from all error conditions. |
| * < | * < | ||
| - | * Automatically recover from one error condition | + | * Automatically recover from one error condition. |
| * < | * < | ||
| * Else, to recover from an errdisabled state, the port must be shut/no shut. | * Else, to recover from an errdisabled state, the port must be shut/no shut. | ||
| Line 91: | Line 186: | ||
| ====Recovery Interval===== | ====Recovery Interval===== | ||
| * When enabled, the default recovery interval is 300 secs (5 mins) | * When enabled, the default recovery interval is 300 secs (5 mins) | ||
| - | * Modify recovery interval by | + | * Modify recovery interval |
| * < | * < | ||
| < | < | ||
| * < | * < | ||
| + | ====Verification==== | ||
| + | * View a single interface status line protocol. | ||
| + | * < | ||
| + | TenGigabitEthernet1/ | ||
| + | * View all interface status line protocols. | ||
| + | * < | ||
| + | * View all errdisable reason status' | ||
| + | * < | ||
| + | ErrDisable Reason | ||
| + | ----------------- | ||
| + | arp-inspection | ||
| + | bpduguard | ||
| + | channel-misconfig | ||
| + | dhcp-rate-limit | ||
| + | dtp-flap | ||
| + | gbic-invalid | ||
| + | inline-power | ||
| + | l2ptguard | ||
| + | link-flap | ||
| + | mac-limit | ||
| + | link-monitor-failure | ||
| + | loopback | ||
| + | oam-remote-failure | ||
| + | pagp-flap | ||
| + | port-mode-failure | ||
| + | pppoe-ia-rate-limit | ||
| + | psecure-violation | ||
| + | security-violation | ||
| + | sfp-config-mismatch | ||
| + | storm-control | ||
| + | udld | ||
| + | vmps | ||
| + | psp Enabled | ||
| + | dual-active-recovery | ||
| + | evc-lite input mapping fa Disabled | ||
| + | Timer interval: 30 seconds | ||
| + | |||
| + | Interfaces that will be enabled at the next timeout:</ | ||
| + | |||
| + | =====Switchport Security Configuration===== | ||
| + | * Port security configuration for a single MAC address, from the first learned MAC address. | ||
| + | - Change port mode to access port. | ||
| + | * < | ||
| + | - Configure port security to allow first MAC that is seen connected to the port, or in the CAM table already. | ||
| + | * < | ||
| + | - Configure only one MAC address to be learned. | ||
| + | * < | ||
| + | - Configure violation mode. | ||
| + | * < | ||
| + | - Enable port-security (must be done). | ||
| + | * < | ||
| + | - Verify port-security configuration. | ||
| + | * < | ||
| + | Port Security | ||
| + | Port Status | ||
| + | Violation Mode : Shutdown | ||
| + | Aging Time : 1 mins | ||
| + | Aging Type : Inactivity | ||
| + | SecureStatic Address Aging : Enabled | ||
| + | Maximum MAC Addresses | ||
| + | Total MAC Addresses | ||
| + | Configured MAC Addresses | ||
| + | Sticky MAC Addresses | ||
| + | Last Source Address: | ||
| + | Security Violation Count : 0</ | ||
| + | - Optional: Configure automated port recovery. | ||
| + | * < | ||
| + | - If no automated recovery is configured, then the port has to be **shut/no shut** to recover. | ||
| + | - Optional: Change recovery timer, in seconds. | ||
| + | * < | ||
| + | switch#show errdisable recovery | i interval | ||
| + | Timer interval: 30 seconds</ | ||
| ======Backlinks====== | ======Backlinks====== | ||
| [[cisco: | [[cisco: | ||
cisco/certification_topics/ccie-ei/1.1.aii.1763910606.txt.gz · Last modified: by Name
Page Tools
