A dynamic MAC address is learned automatically when a switch receives a frame from a device. The switch records the address in its MAC address table without manual configuration. section 12.2.3
Regular dynamic MAC addresses age out after five minutes without traffic, and receiving another frame resets the timer. This removes stale entries as devices leave the LAN. Port Security changes the default behavior: dynamically learned secure MAC addresses remain indefinitely while their port stays up unless secure aging is enabled. section 12.2.2
Dynamic MAC addresses have these operational characteristics:
- Require no manual MAC-address configuration and provide a hands-off way to learn permitted devices. section 12.2.3
- Disappear when a Port Security–enabled port goes down, allowing the port to learn a new dynamic secure address. section 12.2.3
- Count toward the port’s maximum secure-MAC limit; a port connected to multiple devices may require switchport port-security maximum maximum. section 12.1.2 section 12.3
- Differ from static secure MAC addresses, which are manually configured and persist through a port outage, and from sticky addresses, which are learned dynamically but saved in running-config. section 12.2.3
Learning and verifying dynamic secure addresses
Configure an access port for Port Security, then inspect its learned address: `interface f0/1`, `switchport mode access`, and `switchport port-security`. `show port-security interface f0/1` reports the maximum and current totals; for example, Maximum MAC Addresses 1 and Total MAC Addresses 1 show that one secure MAC address has been learned. Use `show port-security address` to identify it as SecureDynamic.
Enabling secure aging
On a Port Security interface, `switchport port-security aging time 5` enables a five-minute aging timer. The default aging type is absolute, so the timer does not reset when frames arrive. `switchport port-security aging type inactivity` changes the behavior so traffic resets the timer and preserves an active address.
