User Tools
cisco:certification_topics:ccie-ei:1.1.aii
Differences
This shows you the differences between two versions of the page.
| Both sides previous revisionPrevious revisionNext revision | Previous revision | ||
| cisco:certification_topics:ccie-ei:1.1.aii [2025/11/23 15:31] – Name | cisco:certification_topics:ccie-ei:1.1.aii [2025/11/23 17:11] (current) – Name | ||
|---|---|---|---|
| Line 26: | Line 26: | ||
| Last Source Address: | Last Source Address: | ||
| Security Violation Count : 0</ | Security Violation Count : 0</ | ||
| + | ====Administrative Mode==== | ||
| + | * The Administrative Mode **static access** or **trunk** to enable port-security on a port. | ||
| + | * < | ||
| + | Name: Te1/0/1 | ||
| + | Switchport: Enabled | ||
| + | Administrative Mode: static access | ||
| + | switch(config)# | ||
| + | switch(config-if)# | ||
| + | * < | ||
| + | Name: Te1/0/3 | ||
| + | Switchport: Enabled | ||
| + | Administrative Mode: trunk | ||
| + | |||
| + | switch(config)# | ||
| + | switch(config-if)# | ||
| + | * The default of **dynamic auto** will result in a rejected **switchport port-security** command. | ||
| + | * < | ||
| + | Name: Te1/0/2 | ||
| + | Switchport: Enabled | ||
| + | Administrative Mode: dynamic auto | ||
| + | |||
| + | switch(config-if)# | ||
| + | Command rejected: TenGigabitEthernet1/ | ||
| ====Aging Time==== | ====Aging Time==== | ||
| * By default, secure MAC addresses will not age out. | * By default, secure MAC addresses will not age out. | ||
| Line 48: | Line 71: | ||
| * Can be enabled by. | * Can be enabled by. | ||
| * < | * < | ||
| + | ====Violation Modes==== | ||
| + | * Determines how port-security will protect the port in case of a violation. | ||
| + | * The modes are: | ||
| + | * protect | ||
| + | * Discard traffic from unauthorized hosts. | ||
| + | * The interface will remain up if more than the maximum number of addresses is learned, but traffic violating devices are dropped and no log entry is generated. | ||
| + | * Keyword: No log entry. | ||
| + | * restrict | ||
| + | * The interface will remain up if more than the maximum number of addresses is learned, but traffic violating devices is dropped and a log entry is generated. | ||
| + | * shutdown | ||
| + | * Shutdowns the port if more than the maximum number of allowable MAC addresses are learned on the interface. | ||
| + | * Defined per port by. | ||
| + | * < | ||
| + | protect | ||
| + | restrict | ||
| + | shutdown | ||
| + | | ||
| + | =====Sticky MAC addresses===== | ||
| + | ====General==== | ||
| + | * There are two type of sticky secure MAC address. | ||
| + | - An incoming packet, with a MAC address, is automatically assigned to that port. | ||
| + | - The MAC address is statically defined. | ||
| + | * By default, when enabled, one MAC address is allowed per port. | ||
| + | * Sticky secure MAC address learning can be enabled, per interface, by. | ||
| + | * < | ||
| + | H.H.H 48 bit mac address | ||
| + | < | ||
| + | * < | ||
| + | * Sticky secure MAC address will never age out. | ||
| + | * If the command, **switchport port-security mac-address sticky** is issued, then all current dynamically-learned secure MAC addresses will be converted to sticky secure MAC addresses. | ||
| + | * Sticky secure MAC address learning can be disabled by. | ||
| + | * < | ||
| + | * All current sticky secure MAC addresses will be converted to regular dynamically-learned secure MAC address. | ||
| + | ====Types==== | ||
| + | * Secure MAC addresses will be added to the MAC address table like any other MAC address. | ||
| + | * Sticky and Static secure MAC addresses will have a type of STATIC. | ||
| + | * Dynamically-learned secure MAC addresses will have a type of DYNAMIC. | ||
| + | * To view all secure MAC addresses. | ||
| + | * < | ||
| + | Mac Address Table | ||
| + | ------------------------------------------- | ||
| + | |||
| + | Vlan Mac Address | ||
| + | ---- ----------- | ||
| Line 94: | Line 161: | ||
| ====Configuration===== | ====Configuration===== | ||
| - | * To configure all causes | + | |
| + | | ||
| * < | * < | ||
| - | * To configure one cause | + | * To configure one cause. |
| * < | * < | ||
| * < | * < | ||
| - | * To disable all causes | + | * To disable all causes. |
| * < | * < | ||
| - | * To disable one cause | + | * To disable one cause. |
| * < | * < | ||
| * < | * < | ||
| ====Recovery Options===== | ====Recovery Options===== | ||
| - | * Automatically recover from all error conditions | + | * Automatically recover from all error conditions. |
| * < | * < | ||
| - | * Automatically recover from one error condition | + | * Automatically recover from one error condition. |
| * < | * < | ||
| * Else, to recover from an errdisabled state, the port must be shut/no shut. | * Else, to recover from an errdisabled state, the port must be shut/no shut. | ||
| Line 118: | Line 186: | ||
| ====Recovery Interval===== | ====Recovery Interval===== | ||
| * When enabled, the default recovery interval is 300 secs (5 mins) | * When enabled, the default recovery interval is 300 secs (5 mins) | ||
| - | * Modify recovery interval by | + | * Modify recovery interval |
| * < | * < | ||
| < | < | ||
| * < | * < | ||
| + | ====Verification==== | ||
| + | * View a single interface status line protocol. | ||
| + | * < | ||
| + | TenGigabitEthernet1/ | ||
| + | * View all interface status line protocols. | ||
| + | * < | ||
| + | * View all errdisable reason status' | ||
| + | * < | ||
| + | ErrDisable Reason | ||
| + | ----------------- | ||
| + | arp-inspection | ||
| + | bpduguard | ||
| + | channel-misconfig | ||
| + | dhcp-rate-limit | ||
| + | dtp-flap | ||
| + | gbic-invalid | ||
| + | inline-power | ||
| + | l2ptguard | ||
| + | link-flap | ||
| + | mac-limit | ||
| + | link-monitor-failure | ||
| + | loopback | ||
| + | oam-remote-failure | ||
| + | pagp-flap | ||
| + | port-mode-failure | ||
| + | pppoe-ia-rate-limit | ||
| + | psecure-violation | ||
| + | security-violation | ||
| + | sfp-config-mismatch | ||
| + | storm-control | ||
| + | udld | ||
| + | vmps | ||
| + | psp Enabled | ||
| + | dual-active-recovery | ||
| + | evc-lite input mapping fa Disabled | ||
| + | |||
| + | Timer interval: 30 seconds | ||
| + | |||
| + | Interfaces that will be enabled at the next timeout:</ | ||
| + | =====Switchport Security Configuration===== | ||
| + | * Port security configuration for a single MAC address, from the first learned MAC address. | ||
| + | - Change port mode to access port. | ||
| + | * < | ||
| + | - Configure port security to allow first MAC that is seen connected to the port, or in the CAM table already. | ||
| + | * < | ||
| + | - Configure only one MAC address to be learned. | ||
| + | * < | ||
| + | - Configure violation mode. | ||
| + | * < | ||
| + | - Enable port-security (must be done). | ||
| + | * < | ||
| + | - Verify port-security configuration. | ||
| + | * < | ||
| + | Port Security | ||
| + | Port Status | ||
| + | Violation Mode : Shutdown | ||
| + | Aging Time : 1 mins | ||
| + | Aging Type : Inactivity | ||
| + | SecureStatic Address Aging : Enabled | ||
| + | Maximum MAC Addresses | ||
| + | Total MAC Addresses | ||
| + | Configured MAC Addresses | ||
| + | Sticky MAC Addresses | ||
| + | Last Source Address: | ||
| + | Security Violation Count : 0</ | ||
| + | - Optional: Configure automated port recovery. | ||
| + | * < | ||
| + | - If no automated recovery is configured, then the port has to be **shut/no shut** to recover. | ||
| + | - Optional: Change recovery timer, in seconds. | ||
| + | * < | ||
| + | switch#show errdisable recovery | i interval | ||
| + | Timer interval: 30 seconds</ | ||
| ======Backlinks====== | ======Backlinks====== | ||
| [[cisco: | [[cisco: | ||
cisco/certification_topics/ccie-ei/1.1.aii.1763911916.txt.gz · Last modified: by Name
Page Tools
