Port-security sticky and aging

[sbrobak]

Should it be possible to age out sticky mac adresses? Running 2950/3550.

switchport port-security mac-address sticky

switchport port-security aging time x

[skarundi]

No it is not possible to age out sticky entries.

Entry is added to the config, so only way to get it out is to remove the port security mac address entry from the config.

[BrianSekleckiGE]

Should we file a bug request / feature request for this with Cisco?

It would be helpful to have Sticky MAC Address with Aging:

- Sticky still applies for persistent MACs in the config through reboots

- If a port is down or inactive for a certain period of time, the MAC is aged out of the config (prevents MITM)

-- Remote ops center operators have a certain threshold to investigate secure port violations 

-- Allows operators w/o admin access to replace a secure device if they can force it down / offline beyond the threshold

- A MITM attacker reboots a switch with power cycle, the attack fails