3

The switchport port-security violation shutdown , shuts the port (err-disabled) when the policy is violated. But, for restrict and protect modes there isn't a mention of shutting a port down. So, can the policy be violated unlimited number of times when a switch port is configured with : switchport port-security violation restrict(or protect)

7

Yes, the restrict and protect modes can be violated any number of times without shutting down the port since they are not designed to do that; they will drop packets with unknown source addresses:

See Configuring the Port Security Violation Mode on a Port on page 62-6:

  • protect—Drops packets with unknown source addresses until you remove a sufficient number of secure MAC addresses to drop below the maximum value.
  • restrict—Drops packets with unknown source addresses until you remove a sufficient number of secure MAC addresses to drop below the maximum value and causes the SecurityViolation counter to increment.
  • shutdown—Puts the interface into the error-disabled state immediately and sends an SNMP trap notification.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.