Previously we configured this port with a static Mac address, the disadvantage with that method
is that you have to manually configure every Mac address that you want to add to your system.
So if you had a 48 port switch and you wanted to permit two Mac addresses per port, that's already 96 Mac addresses
that you need to configure.
So that's a lot of work on this Port Gigabit 00.
We simply enabled port security.
But the problem with that method is when the switch reboots, well, the port goes down and then comes
up again and new Mac address can simply be launched.
So if we want to limit that port to specific MAC addresses and add those Mac addresses to the configuration
automatically, we could use the command switchboard port security MAC address
and now, rather than manually configuring the Mac address, we can use the option sticky to configure
a dynamic, secure Mac address, a sticky now to put that in plain English, that essentially adds the
Mac address to the running configuration of the switch.
So when the Mac address is discovered, we talked to this command, but notice this command was automatically
added to the configuration.
That Mac address wasn't there previously.
We only typed these two commands, but now when we added this command, the Mac address was automatically
added to the configuration.
The advantage with that is that when we save the configuration.
So notice when we go to the start up config at the moment, no Mac address has been added to the start
up config, but as soon as we save the configuration and then look at these start up config
that Mac address has added. So show start up config
Mac address has been added, so the advantage of that is, once again, if you have a 48 port switch
and you want to add a Mac address per port, you don't have to configure 48 Mac addresses statically or
if you want to allow two Mac addresses per port, you don't have to configure 96 Mac addresses.
You can simply use the sticky option and allow the switch to learn the Mac addresses and then you save
your config.
Just remember, you need to make sure that the Mac address has learnt initially of the correct Mac addresses.
The idea is, is that you initially control which devices access the network and hence which Mac addresses
are learnt.
So the advantage of sticky once again is that you don't have to manually type all the Mac addresses
in.
When a violation occurs at the moment, we've configured the ports to shut down SASHO port security.
Shows us that the security action, when there's a violation is to shut the port down.
So as an example, if we change the Mac address of the first router.
Do some other value, let's say 4
an error disable message is displayed
and the port is put into error disabled state, and that was caused by this Mac address being learnt on
the port.
So now show interface status shows us
that the port is error disabled, the problem here is that you would have to manually re-enable that
port, which causes a large administrative overhead.
So rather than doing that, you can go into global configuration mode on the switch and use the error
disable recovery command to specify a cause and a recovery value.
So there are multiple causes here, but the one that we're looking for is this one port security violation
and then we could say error disable recovery interval and specify an interval for recovery, so I'll
go on to gigabit00 shut to the port down
and then no, shut it sent some traffic
from this router on port, 1 to the other router
and what we should see is that an error disabled message takes place when a security violation occurs.
So let's confirm our config.
At the moment
traffic is failing and now we get a irresistable violation taking place,
so port has gone down.
But what I'll do now is configure the Mac address to what it should be and then I'll do a continuous
ping
and hopefully after a while
that should start succeeding, so notice the port does not come up again after 30 seconds, pings are
still failing.
We have to wait for spanning tree and other protocols to converge, and again, I'm impatient here,
I'll speed up the video so that you don't have to wait for the entire process to take place.
But there you go, notice the ping started succeeding.
So scrolling up, we had an error disabled message.
Because there was a port security violation caused by this Mac address, port went down, but then there
was an error recovery with the switch attempted to recover from the port security violation error,
disable on gigabit 00 and the port came up.
So it succeeded
but if I change the Mac address again
error occurs port violation.
Set it back to what it should be while we're waiting for it to recover, show port security, at the
moment a security violation has occurred on gigabit 00.
We can see the last Mac address lunch because of the security violation.
The port is shut down at the moment, but now the port was shut down when I showed the output, but
now it's recovering.
So if I do, the command again can see as an example that the port is going up, so do the command again.
We can see the port has come up again.
There's no security violation on this port.
So that's a nice way to recover from a shutdown through port security.
Use sticky in this example to configure Mac addresses, and we can do an automatic recovery by using
the error disable global configuration command, saying recovery causes port security violation and
it's going to take 30 seconds before it tries to recover.
You could obviously set that to a larger number.
But as an example, if a user by mistake connected the wrong device to the port, the traffic would
be blocked and a log message would be generated.
But if they then connected the right device to the port, you wouldn't have to telnet to the switch
as an example and re-enable port
it would automatically be enabled.