Port Security Aging question...

[rezaalikhani]

Hi all;

The following is the configuration that I have applied to an interface:

3560#show run in fas 0/7

Building configuration...

Current configuration : 122 bytes

!

interface FastEthernet0/7

switchport mode access

switchport port-security

switchport port-security aging time 1

end

3560#

After 1 minute, the PC that is connected to that port disconnects from the network and the port's status becomes err-disabled.

Is it normal?

Thanks

[David VR]

Hello,

Could you please check the following command on your interface.

show port-security interface fa0/7

show port-security address

Perhaps you are reaching the maximum allowed MAC address on the interface.

[rezaalikhani]

Thanks for your reply;

3560#show port-security interface fastEthernet 0/7
Port Security              : Enabled
Port Status                : Secure-shutdown
Violation Mode             : Shutdown
Aging Time                 : 1 mins
Aging Type                 : Absolute
SecureStatic Address Aging : Disabled
Maximum MAC Addresses      : 1
Total MAC Addresses        : 0
Configured MAC Addresses   : 0
Sticky MAC Addresses       : 0
Last Source Address:Vlan   : 0050.56c0.0000:1
Security Violation Count   : 1

3560#

and

3560#show port-security address
          Secure Mac Address Table
--------------------------------------------------------------------------
Vlan    Mac Address       Type                       Ports   Remaining Age
                                                                (mins)
----    -----------       ----                       -----   -------------
   1    0011.3b18.f8bd    SecureDynamic              Fa0/7        1
--------------------------------------------------------------------------
Total Addresses in System (excluding one mac per port)     : 0
Max Addresses limit in System (excluding one mac per port) : 2048
3560#
*Mar  3 00:40:43.921: %PM-4-ERR_DISABLE: psecure-violation error detected on Fa0/7, putting Fa0/7 in err-disable state
3560#
*Mar  3 00:40:43.930: %PORT_SECURITY-2-PSECURE_VIOLATION: Security violation occurred, caused by MAC address 0050.56c0.0000 on port FastEthernet0/7.
3560#
*Mar  3 00:40:44.928: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/7, changed state to down
3560#
*Mar  3 00:40:45.926: %LINK-3-UPDOWN: Interface FastEthernet0/7, changed state to down
3560#show port-security address
          Secure Mac Address Table
--------------------------------------------------------------------------
Vlan    Mac Address       Type                       Ports   Remaining Age
                                                                (mins)
----    -----------       ----                       -----   -------------
--------------------------------------------------------------------------
Total Addresses in System (excluding one mac per port)     : 0
Max Addresses limit in System (excluding one mac per port) : 2048
3560#

[paul driver]

Hello

aging is set to 1 minute -meaning after this time the Mac will be removed (flushed) from the cam table

The reason why the port is be errdisabled was due to the mac address maximum limit was reached?

As you can see:

Last Source Address:Vlan   : 0050.56c0.0000:1
Security Violation Count   : 1

          Secure Mac Address Table
--------------------------------------------------------------------------
Vlan    Mac Address       Type                       Ports   Remaining Age
                                                                (mins)
----    -----------       ----                       -----   -------------
   1    0011.3b18.f8bd    SecureDynamic              Fa0/7        1
--------------------------------------------------------------------------

res

paul

[rezaalikhani]

Thanks for the reply;

3560#
*Mar  3 00:40:43.921: %PM-4-ERR_DISABLE: psecure-violation error detected on Fa0/7, putting Fa0/7 in err-disable state
3560#

Is it sufficient?

[David VR]

You could perhaps try to increase the max allowed MAC addresses:

switchport port-security maximum 5 and check if that help.