nx.os.and.cisco.nexus.switching.2nd.edition.1587143046

violation; the interface is error-disabled. Reenabling the interface, it retains its port
security configuration, including its secure MAC addresses.
• errdisable: Global configuration command to configure the device to reenable the
interface automatically if a shutdown occurs, or you can manually reenable the
interface by entering the shutdown and no shutdown interface configuration
commands.
• restrict: After 100 security violations occur, the device disables learning on the
interface and drops all ingress traffic from nonsecure MAC addresses. In addition, the
device generates an SNMP notification for each security violation. The address that
triggered the security violation is learned, but any traffic from the address is dropped.
• protect: Prevents further violations from occurring. The address that triggered the
security violation is learned, but any traffic from the address is dropped.
Note
The default security action is to shut down the port on which the security violation
occurs.
Example 5-60 shows how to configure the specific port security violations on interface
Ethernet 1/1.
Example 5-60. Configuring the Specific Port Security Violations on Interface Ethernet
1/1
Click here to view code image
Egypt# conf t
Enter configuration commands, one per line. End with
CNTL/Z.
Egypt(config)# interface ethernet 1/1
Egypt(config-if)# switchport port-security violation ?
protect Security violation protect mode
restrict Security violation restrict mode
shutdown Security violation shutdown mode
Egypt(config-if)# switchport port-security violation
Example 5-61 shows how to configure a maximum number of MAC addresses on Interface
Ethernet 1/1. Depending on what connects to the interface, such as a virtualized server, you
need to increase the number of MAC addresses, based on the number of virtual machines
and virtual interfaces.
Note