A dynamic switch port uses DTP to negotiate whether it operates as an access or trunk port. Because its mode is not explicitly configured, Cisco IOS rejects Port Security on the interface. section 12.1.2 section 12.3
Before enabling Port Security:
- Configure the interface explicitly with switchport mode access or switchport mode trunk. section 12.1.2
- Enable Port Security afterward with switchport port-security. section 12.1.2
- Verify the resulting interface settings with show port-security interface interface. section 12.3
SW1(config)# interface range f0/1-2 SW1(config-if-range)# switchport port-security #1 Command rejected: FastEthernet0/1 is a dynamic port. #2 #1 Enables Port Security #2 The command is rejected.
The CLI transcript shows IOS rejecting Port Security on a dynamic port, then accepting it after access mode is configured. section 12.1.2
