Regarding Cisco port-security.
Is mac address aging just for dynamic/sticky mac addresses?
Does the ageing play any part in a statically configured mac address?
If no static or sticky configuration is configured, does the ageing come into play?
Add a comment
|
1 Answer
You can configure an interface to convert the dynamic MAC addresses to sticky secure MAC addresses and to add them to the running configuration by enabling sticky learning. To enable sticky learning, enter the switchport port-security mac-address sticky command. When you enter this command, the interface converts all the dynamic secure MAC addresses, including those that were dynamically learned before sticky learning was enabled, to sticky secure MAC addresses.
The sticky secure MAC addresses do not automatically become part of the configuration file, which is the startup configuration used each time the switch restarts. If you save the sticky secure MAC addresses in the configuration file, when the switch restarts, the interface does not need to relearn these addresses. If you do not save the configuration, they are lost.
So they wont be ageing from port security, mac address only ageing from CAM and ARP. Port security and ARP table are two different concepts.
answered Feb 10, 2017 at 14:26
-
So mac address-table aging-time # and switchport port-security aging time # do the same thing? Commented Feb 10, 2017 at 15:32
-
Not really, one is removing mac entries from mac address table and is always switch on. Another one by default is off, so by default port security is not removing any mac addresses. But that could be switch on to remove and add PC's on a secure port without manually deleting the existing secure mac addresses while still limit the number of secure addresses on port. Commented Feb 10, 2017 at 15:38
-
I think my misunderstanding actually lies with the ‘protected’ violation mode. If I turn on port security and configure it with the following; the maximum number of mac addresses to 1, the violation mode to protect, the ageing time to 10 minutes. If in the future I replace the device on the switchport. Will the new devices packets be dropped? If so would I have to configure the switch to accept the new mac address and drop the old mac address? or would this change happen automatically? Would I need to wait 10 minutes? Commented Feb 10, 2017 at 16:44
-
Not really, for automatic recovery of errdisabled port you need to use #errdisable recovery cause security-violation Ageing time would just remove mac address from port if after timer expires no mac is currently present on port, it won't enable already disabled port. Commented Feb 10, 2017 at 16:48
-
So it would not happen automatically and I would have to configure it? Even with protected violation mode? Commented Feb 10, 2017 at 17:00