Site Tools


cisco:certification_topics:ccie-ei:1.1.aii

Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revisionPrevious revision
cisco:certification_topics:ccie-ei:1.1.aii [2025/11/23 16:56] Namecisco:certification_topics:ccie-ei:1.1.aii [2025/11/23 17:11] (current) Name
Line 231: Line 231:
 Interfaces that will be enabled at the next timeout:</code> Interfaces that will be enabled at the next timeout:</code>
  
 +=====Switchport Security Configuration=====
 +  * Port security configuration for a single MAC address, from the first learned MAC address.
 +    - Change port mode to access port.
 +      * <code>switch(config-if)#switchport mode access</code>
 +    - Configure port security to allow first MAC that is seen connected to the port, or in the CAM table already.
 +      * <code>switch(config-if)#switchport port-security mac-address sticky</code>
 +    - Configure only one MAC address to be learned.
 +      * <code>switch(config-if)#switchport port-security maximum 1</code>
 +    - Configure violation mode.
 +      * <code>switch(config-if)#switchport port-security violation shutdown</code>
 +    - Enable port-security (must be done).
 +      * <code>switch(config-if)#switchport port-security</code>
 +    - Verify port-security configuration.
 +      * <code>switch#show port-security interface t1/0/1
 +Port Security              : Enabled
 +Port Status                : Secure-down
 +Violation Mode             : Shutdown
 +Aging Time                 : 1 mins
 +Aging Type                 : Inactivity
 +SecureStatic Address Aging : Enabled
 +Maximum MAC Addresses      : 1
 +Total MAC Addresses        : 1
 +Configured MAC Addresses   : 0
 +Sticky MAC Addresses       : 1
 +Last Source Address:Vlan   : 0000.0000.0000:0
 +Security Violation Count   : 0</code>
 +    - Optional: Configure automated port recovery.
 +      * <code>switch(config)#errdisable recovery cause all</code>
 +    - If no automated recovery is configured, then the port has to be **shut/no shut** to recover.
 +    - Optional: Change recovery timer, in seconds.
 +      * <code>switch(config)#errdisable recovery interval 30
 +switch#show errdisable recovery | i interval
 +Timer interval: 30 seconds</code>
  
 ======Backlinks====== ======Backlinks======
 [[cisco:certification_topics:ccie-ei|CCIE-EI v1.1]]\\  [[cisco:certification_topics:ccie-ei|CCIE-EI v1.1]]\\ 
cisco/certification_topics/ccie-ei/1.1.aii.1763916968.txt.gz · Last modified: by Name