Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Community Member

switchport port-security

Hi,

I'm trying to configure port-security on my port. I want to allow my Avaya VoIP phone and my laptop to only access this port. However, I configured port-security on the port with switchport port-security mac-address HHHH.HHHH.HHHH. Ofcourse I configured two, one for my laptop and one for the phone. However, when I configure switchport port-security maximum 2. The port shutsdown. When I configure switchport port-security 3, everything went fine. Here's the config.

interface FastEthernet5/28

description JOHNLOPEZ

switchport access vlan 20

switchport mode access

switchport voice vlan 3

switchport port-security

switchport port-security maximum 3

switchport port-security violation restrict

switchport port-security mac-address 0004.0de9.3833

switchport port-security mac-address 0016.4159.641f

service-policy output autoqos-voip-policy

logging event link-status

qos trust dscp

auto qos voip trust

tx-queue 3

priority high

shape percent 33

end

4500B#sh mac-add int fa5/28

Unicast Entries

vlan mac address type protocols port

-------+---------------+--------+---------------------+--------------------

3 0004.0de9.3833 static ip,ipx,assigned,other FastEthernet5/28

20 0004.0de9.3833 static ip,ipx,assigned,other FastEthernet5/28

20 0016.4159.641f static ip,ipx,assigned,other FastEthernet5/28

4500B#sh port-security int fa5/28

Port Security : Enabled

Port Status : Secure-up

Violation Mode : Restrict

Aging Time : 0 mins

Aging Type : Absolute

SecureStatic Address Aging : Disabled

Maximum MAC Addresses : 3

Total MAC Addresses : 3

Configured MAC Addresses : 2

Sticky MAC Addresses : 0

Last Source Address:Vlan : 0004.0de9.3833:3

Security Violation Count : 0

4500B#

Any idea why should it be 3? Thanks.

-John

9 REPLIES
Community Member

Re: switchport port-security

Hi John,

It seems that you have define 3 MACs address NOT 2.

4500B#sh mac-add int fa5/28

Unicast Entries

vlan mac address type protocols port

-------+---------------+--------+---------------------+--------------------

3 0004.0de9.3833 static ip,ipx,assigned,other FastEthernet5/28

20 0004.0de9.3833 static ip,ipx,assigned,other FastEthernet5/28

20 0016.4159.641f static ip,ipx,assigned,other FastEthernet5/28

Please remove one of them and it should work for you.

Regards,

Jaffer

Community Member

Re: switchport port-security

Hi Jaffer,

I tried to remove all static mapping then re-apply it again. But there are really 3 MAC registered on that port defined as static. Also, in the configuration, there are only 2 defined static MAC for the port-security command. What I want to do is to only define a maximum of 2. One MAC for the laptop and one MAC for the VoIP phone.

-John

Community Member

Re: switchport port-security

Hi John,

As per this document : http://www.cisco.com/univercd/cc/td/doc/product/lan/cat6000/122sx/swcg/port_sec.htm#wp1053357 you are configuring your port security properly.

Just double check your work and run this company to see how many MACs showing

Router# show port-security address

Thanks,

Jaffer

Community Member

Re: switchport port-security

Actually there are only two MAC addresses registered. It looks like one mac is registering in two vlans. You have voice vlan 3 and data vlan 20 configured on this port and the port is not configured as a trunk. Try configuring the port as a trunk and then configure the port security.

Community Member

Re: switchport port-security

Actually, I'm really confused right now. I don't know why my IP phone which is in VLAN 3 registered it's MAC address in VLAN 20 also. This is what's on my mind. When I configured switchport port-security mac-address on the port, the port is assuming that both MAC address will appear on VLAN 20 (my data vlan). If I set the maximum MAC to 2. Then the MAC address of the IP phone that is trying to register it's MAC on the port will be disallowed because I already configured two static MAC on the port (which the port assumed that both will appear in VLAN 20). I will try to test in on another laptop. I'll get back to you on this.

Community Member

Re: switchport port-security

It worked guys. I tried to plugin another laptop then the it was restricted to access the network. It didn't get an IP address from the DHCP server. I also checked the logs and the switch says that there's a port-security violation. So I think the switchport port-sec mac-add command is just for the data vlan and not for the voice vlan. So I "think" I need to specify max of 3 MAC so the phone can register it's MAC address on VLAN 3. I dunno, it's weird. =)

Re: switchport port-security

The reason the Avaya handset registers on the Data VLAN is due to the way it boots.

When it first comes up, it uses the Data VLAN to get it's DHCP address, the DHCP setver provides additional information in the scope, including a flag to use trunkiung, and if so which VLAN to use for voice. The phone then requests another address on the Voice VLAN.

The switch doesn't handle this too well, and thinks you have two seperate devices, with the same MAC address.

Community Member

Re: switchport port-security

Oh ya! That's a great input. Thanks Mark. What I noticed was when I configure switchport port-sec max 2, the phone freezes. It doesn't have a dial tone but my laptop is still connected to the network. Maybe it blocks the MAC address on the Voice VLAN. When I checked other ports, in only has two MAC address on the port (one for VLAN 3 and 20). But maybe the switch flushed the MAC address registered on VLAN 20 that's supposed to be in VLAN 3 (when it was still discovering for DHCP). Mine was statically configured that's why I have 3. Thanks for the great input. :)

Re: switchport port-security

John,

I believe thet with port-security the swith blocks the address that exceeds the limitation. So in your case the first address seen is the MAC of the phone on the Data VLAN. Second is the laptop, as the phone starts forwarding traffic as soon as it loads, and last the MAC of the phone on the Voice VLAN.

The reason the other ports have only 2 MAC addresses is probably because they have been running a while, and the arp cache has timed out.

** Please rate posts if helpfull **

473
Views
5
Helpful
9
Replies
CreatePlease to create content