Volume 2 - Chapter 11: Implementing Switch Port Security Flashcards
True or False:
Switchport port security can be enabled on both access and trunk interfaces.
True, both access and trunk interfaces support port security.
However, the interface must be set statically to a trunk or access interface.
What is the command to set the maximum amount of violations that can be tolerated with port security?
switchport port-security maximum number
What is the command to set the violation type of port security for a specific interface?
switchport port-security violation protect / restrict / shutdown
What is the command to set an allowed static MAC address for an interface with port security enabled?
switchport port-security mac-address mac-address
What is the command to enable a sticky MAC address to be dynamically learned?
switchport port-security mac-address sticky
True or False:
MAC-addresses learned by sticky configuration will be saved to the startup-configuration automatically.
False; until the running configuration is saved to memory manually, the sticky MACs that are learned on an interface will be lost if the switch reboots.
What adjustment to the interface configuration is recommended when port-security is enabled on a voice port?
The maximum allowed MAC addresses should be increased to 2; one for the workstation, one for the phone.
True or False:
Port Security can be enabled on port-channel (EtherChannel) interfaces.
True; but make sure you configure the port-security commands on the port-channel interface, and not on the physical interfaces.
What command can be used to check the current port-security statistics on an interface?
show port-security interface interfacename
Describe the difference between the following commands:
show mac address-table secure
show mac address-table static
Secure; shows only MAC addresses that are associated with ports that have port security enabled.
Static; shows MAC addresses that are associated with ports that have port security enabled, as well as all statically configured MACs
MAC addresses that are learned or configured on port-security enabled interfaces are no longer considered to be ____ ____.
dynamically learned.
What are the 3 commands that can be used to list MAC addresses learned or configured with port-security?
show mac address-table static
show mac address-table secure
show mac address-table
Describe the difference between the port-security “restrict” and “protect” modes.
Both restrict and protect will both discard traffic when pushed past the maximum, but only restrict will generate a log entry and send an SNMP trap.
What command can be used to enable automatic recovery of ports in an err-disable state due to port-security?
errdisable recovery cause psecure-violation
What command can be used to set the recovery interval used to restore interfaces in an err-disable state?
errdisable recovery interval seconds
