A secure MAC address is a MAC address authorized by Port Security to send traffic through a particular switch port. A port learns it when receiving frames, or accepts it through configuration. section 12.1.2 section 12.3
Secure MAC addresses use three persistence models:
- Dynamic addresses are learned automatically, stored in the MAC address table, and forgotten when the port goes down. section 12.2.3
- Static addresses are manually configured, stored in the running configuration and MAC address table, and persist through a port outage. section 12.2.3
- Sticky addresses are learned dynamically but written to the running configuration, so they persist and cannot be aged out. section 12.2.3
By default, a Port Security–enabled port allows one secure MAC address. A frame from another address triggers a violation; shutdown error-disables the port, while restrict and protect discard violating frames without disabling it. section 12.3 section 12.2.1
Verify a learned secure address
show port-security interface f0/1 reports Port Security enabled, a one-address maximum, the current learned-address count, and the most recently learned MAC address. show port-security address distinguishes SecureDynamic from SecureConfigured entries.
SW1(config)# interface f0/1 SW1(config-if)# switchport port-security mac-address sticky #1 SW1(config-if)# do show running-config . . . interface FastEthernet0/1 switchport mode access switchport port-security mac-address sticky switchport port-security mac-address sticky 00e0.4c68.92ff #2 switchport port-security #1 Enables sticky secure MAC address learning #2 A sticky secure MAC address was added to the running-config.
Shows sticky learning enabled on an interface and the learned address added to the running configuration. section 12.2.3
