Previously reconfigure the sport with a steady cam MAC address the disadvantage with that method is
that you have to manually configure every MAC address that you want to add to your system.
So if you had a 48 port switch and you wanted to promote to MAC addresses per port that's already 96
and MAC addresses that you need to configure.
So that's a lot of work.
On this port gigabit 00 we simply enabled port security.
But the problem with that method is when the switch reboots when the port goes down and then comes up
again a new MAC address can simply be learnt.
So if we want to limit that port to specific MAC addresses and add those MAC addresses to the configuration
automatically we can use the command switch for port security.
MAC address and now rather than manually configuring the MAC address we can use the option stickie to
configure a dynamic secure MAC address as sticky.
Now to put that in plain English that essentially adds the MAC address to the running configuration
of the switch.
So when the MAC address is discovered we talked to this command.
But notice the command was automatically added to the configuration that MAC address wasn't previously.
We only taught those two commands.
But now when we added this command the MAC address was automatically added to to the configuration.
The advantage with that is that when we save the configuration
so noticed when we go to the startup config at the moment no MAC address has been added to the startup
config.
But as soon as we save the configuration and then look at the startup config that MAC address is added
so show startup config
MAC address has been added.
So the advantage of that is once again if you have a 48 port switch and you want to add a MAC address
per port you don't have to configure Forty-Eight MAC addresses statically.
If you want to allow two MAC addresses per port you don't have to configure 96 MAC addresses.
You can simply use the stickie option and allow the switch to learn the MAC addresses and then you save
your config.
Just remember you need to make sure that the MAC addresses learnt initially are the correct MAC addresses.
The idea is that you initially control which devices access the network and hence which MAC addresses
are linked.
So the advantage of stickie once again is that you don't have to manually type all the MAC addresses
in when a violation occurs at the moment we've configured the ports to shutdown.
So show port security shows us that the security action when there's a violation is to shut the port
down.
So as an example if we change the MAC address of the first Rodda to some other Valley let's say for
an error a disable message is displayed and the port is put into a disabled state and that was caused
by the MAC address being lent on the port.
So now shoyu interface status shows us
that the port is error disabled.
The problem here is that you would have to manually re-enable that port which causes a large administrative
overhead.
So rather than doing that you can go into a global configuration mode on the switch and use the error
disable recovery command to specify a cause and a recovery value.
So there are multiple causes here but the one that we're looking for is this one port security violation.
And then we could say it disable recovery interval and specify an interval for recovery.
So I'll go into gigabit 00 shut the port down and then shut it will send some traffic from this router
on port one to the other router and what we should see is that an error disable message takes place.
When a security violation occurs
let's confirm or can fake
the moment.
Traffic is failing and now we get a disable violation taking place.
Support has gone down.
But what I'll do know is configure the MAC address to what it should be and then I'll do a continuous
ping and hopefully off for a while
that should start succeeding.
So notice the porters not come up again after 30 seconds.
Pings are still failing.
We have to wait for spending tree and all protocols to converge.
And again I'm impatient to speed up the video see that you don't have to wait for the entire process
to take place.
But there you go.
Notice the pings started succeeding so scrolling up.
We had an error disable message because there was a port security violation caused by this MAC address.
Port went down.
But then there was an error recovery where the switch attempted to recover from the port security violation
error disable on gigabit 00 and the port came up.
So it succeeded.
But if I change the MAC address again
error port violation
set it back to what it should be.
While we're waiting for it to recover show port security at the moment a security violation has occurred
on gigabit 00
we can see the last MAC address learnt because of the security violation.
The port is shut down at the moment but now the port was shut down.
When I showed the output but now it's recovering.
So if I do the command again can see it as an example of the port has gone up.
So do the command again we can see the port has come up again.
There's no security violation on this port.
So that's a nice way to recover from a shutdown through port security.
You sticky in this example to configure MAC addresses and we can do an automatic recovery by using the
disable global configuration Command saying recovery causes port security violation and it's going to
take 30 seconds before it tries to recover.
You could obviously set that to a larger number but as an example if a use by mistake connected the
wrong device to the port the traffic would be blocked and a log message would be generated.
But if they then connected the right device to the port you wouldn't have to telnet to the switches
an example and re-enabled port it would automatically be enabled.