Solved: port security shows dynamic mac instead of static

mahesh18 · ‎11-17-2012

Hi Everyone,

I was configuring port security on interface and i statically config the mac on port fa0/16.

but when i do sh mac address table it still shows that mac learned as dynamic

sh mac address-table int fa0/16

Mac Address Table

-------------------------------------------

Vlan Mac Address Type Ports

---- ----------- -------- -----

20 000f.74d6.934f DYNAMIC Fa0/16

20 f0bf.97de.4f48 DYNAMIC Fa0/16

Total Mac Addresses for this criterion: 2

3550SMIA# sh port-security int fa0/16

Port Security : Enabled

Port Status : Secure-up

Violation Mode : Protect

Aging Time : 5 mins

Aging Type : Inactivity

SecureStatic Address Aging : Disabled

Maximum MAC Addresses : 2

Total MAC Addresses : 2

Configured MAC Addresses : 1

Sticky MAC Addresses : 1

Last Source Address:Vlan : f0bf.97de.4f48:20

Security Violation Count : 0

3550SMIA# sh mac address-table int fa0/16

Mac Address Table

-------------------------------------------

Vlan Mac Address Type Ports

---- ----------- -------- -----

20 000f.74d6.934f DYNAMIC Fa0/16 ***********************************************still shows dynamic

20 f0bf.97de.4f48 DYNAMIC Fa0/16

Total Mac Addresses for this criterion: 2

IT still shows dynamic mac address instead of static.when we config port security with static mac on port it should show that mac as static right?

correct me if i am worng?

thanks

mahesh

Abzal · ‎11-17-2012

What is version of 3550? What shows command:

sh port-security address

Best regards,
Abzal

View solution in original post

Abzal · ‎11-17-2012

I checked it on 3750 switch. And the output is ok it shows static mac addresses.

About your version I cannot explain but your configuration of port-security looks right. Perhaps there is a bug frankly I don't know what problem is.

Try to upgrade IOS.

There is thread similar to yours.

https://supportforums.cisco.com/thread/20752

Hope it will help.

Best regards,
Abzal

View solution in original post

Abzal · ‎11-17-2012

Hi,

When you enable port-security on a port it applies default settings. Static means that it will not age out like dynamic after 5 min. Instead it will stay on table. Static means if you move device that connected on port f1/0/24 to another port traffic will be discarded.

SecureDynamic means F10/24 port learned dynamically the MAC address of your device and is now considered a secured MAC address.

Here is a very useful that might help you.

http://ciscoiseasy.blogspot.com/2010/11/lesson-25-switch-port-security.html

Hope it will help.

Please rate helpful posts.

Best regards,
Abzal

View solution in original post

Abzal · ‎11-17-2012

Hi,

That means you configured port-security mac-address sticky.

3550SMIA# sh port-security int fa0/16

Port Security : Enabled

Port Status : Secure-up

Violation Mode : Protect

Aging Time : 5 mins

Aging Type : Inactivity

SecureStatic Address Aging : Disabled

Maximum MAC Addresses : 2

Total MAC Addresses : 2

Configured MAC Addresses : 1

Sticky MAC Addresses : 1

Last Source Address:Vlan : f0bf.97de.4f48:20

Security Violation Count : 0

It learns mac addresses dynamically.

You need instead of sticky configure it like this:

int g7/0/8

switchport access vlan 24

switchport mode access

switchport voice vlan 30

switchport port-security maximum 2

switchport port-security

switchport port-security violation restrict

switchport port-security mac-address 0016.356e.290f vlan access

switchport port-security mac-address 001f.6c7f.0b51 vlan voice

XXXXX#sh mac ad int g7/0/8

Mac Address Table

-------------------------------------------

Vlan Mac Address Type Ports

---- ----------- -------- -----

24 0016.356e.290f STATIC Gi7/0/8

30 001f.6c7f.0b51 STATIC Gi7/0/8

Total Mac Addresses for this criterion: 2

Here is a link

http://www.cisco.com/en/US/docs/switches/lan/catalyst6500/ios/12.2SX/configuration/guide/port_sec.html

Hope it will help.

Best regards,
Abzal

mahesh18 · ‎11-17-2012

Hi Abzal,

This is what i did

3550SMIA(config-if)#switchport port-security mac-address f0bf.97de.4f48 vlan access

3550SMIA(config-if)#end

3550SMIA#sh run int fa0/16

Building configuration...

Current configuration : 385 bytes

!

interface FastEthernet0/16

switchport access vlan 20

switchport mode access

switchport port-security maximum 2

switchport port-security

switchport port-security aging time 5

switchport port-security violation protect

switchport port-security aging type inactivity

switchport port-security mac-address f0bf.97de.4f48

no logging event link-status

spanning-tree portfast

end

3550SMIA#

3550SMIA#sh mac ad

3550SMIA#sh mac address-table int fa0/16

Mac Address Table

-------------------------------------------

Vlan Mac Address Type Ports

---- ----------- -------- -----

20 f0bf.97de.4f48 DYNAMIC Fa0/16

still shows dynamic

thanks

mahesh

Abzal · ‎11-17-2012

What is version of 3550? What shows command:

sh port-security address

Best regards,
Abzal

mahesh18 · ‎11-17-2012

Hi Abzal,

here is info

3550SMIA#sh ver

Cisco IOS Software, C3550 Software (C3550-IPSERVICESK9-M), Version 12.2(44)SE6, RELEASE SOFTWARE (fc1)

Compiled Mon 09-Mar-09 20:28 by gereddy

Image text-base: 0x00003000, data-base: 0x012A99FC

ROM: Bootstrap program is C3550 boot loader

3550SMIA uptime is 1 week, 5 days, 11 hours, 59 minutes

System returned to ROM by power-on

System restarted at 23:19:24 MST Sun Nov 4 2012

System image file is "flash:c3550-ipservicesk9-mz.122-44.SE6.bin"

This product contains cryptographic features and is subject to United

States and local country laws governing import, export, transfer and

use. Delivery of Cisco cryptographic products does not imply

third-party authority to import, export, distribute or use encryption.

Importers, exporters, distributors and users are responsible for

compliance with U.S. and local country laws. By using this product you

agree to comply with applicable laws and regulations. If you are unable

to comply with U.S. and local laws, return this product immediately.

A summary of U.S. laws governing Cisco cryptographic products may be found at:

http://www.cisco.com/wwl/export/crypto/tool/stqrg.html

If you require further assistance please contact us by sending email to

export@cisco.com.

Cisco WS-C3550-24-PWR (PowerPC) processor (revision D0) with 65526K/8192K bytes of memory.

Processor board ID CAT0722R1DQ

Last reset from warm-reset

Running Layer2/3 Switching Image

Ethernet-controller 1 has 12 Fast Ethernet/IEEE 802.3 interfaces

Ethernet-controller 2 has 12 Fast Ethernet/IEEE 802.3 interfaces

Ethernet-controller 3 has 1 Gigabit Ethernet/IEEE 802.3 interface

Ethernet-controller 4 has 1 Gigabit Ethernet/IEEE 802.3 interface

24 FastEthernet interfaces

2 Gigabit Ethernet interfaces

The password-recovery mechanism is enabled.

384K bytes of flash-simulated NVRAM.

Base ethernet MAC Address: 00:0D:28:BC:FD:80

Motherboard assembly number: 73-8100-07

Power supply part number: 341-0029-02

Motherboard serial number: CAT072101VJ

Power supply serial number: DTH07220Y3N

Model revision number: D0

Motherboard revision number: A0

Model number: WS-C3550-24PWR-SMI

System serial number: CAT0722R1DQ

Configuration register is 0x10F

3550SMIA# sh port

3550SMIA# sh port-security ad

3550SMIA# sh port-security address

Secure Mac Address Table

------------------------------------------------------------------------

Vlan Mac Address Type Ports Remaining Age

(mins)

---- ----------- ---- ----- -------------

20 0009.e8a2.0094 SecureSticky Fa0/14 -

20 000b.be59.cc60 SecureSticky Fa0/14 -

20 000b.bece.bbc9 SecureSticky Fa0/14 -

20 001e.3392.d57a SecureSticky Fa0/14 -

20 0024.7ee1.fb24 SecureSticky Fa0/14 -

20 f0bf.97de.4f48 SecureConfigured Fa0/16 -

20 0016.356e.290f SecureConfigured Fa0/19 -

20 74e5.433b.c8db SecureDynamic Fa0/20 -

20 f07d.6878.85e6 SecureDynamic Fa0/20 -

------------------------------------------------------------------------

Total Addresses in System (excluding one mac per port) : 5

Max Addresses limit in System (excluding one mac per port) : 5120

thanks

mahesh

mahesh18 · ‎11-17-2012

Hi Abzal,

Which IOS are u using as i try same thing on another switch and no luck

thanks

mahesh

Abzal · ‎11-17-2012

I checked it on 3750 switch. And the output is ok it shows static mac addresses.

About your version I cannot explain but your configuration of port-security looks right. Perhaps there is a bug frankly I don't know what problem is.

Try to upgrade IOS.

There is thread similar to yours.

https://supportforums.cisco.com/thread/20752

Hope it will help.

Best regards,
Abzal

mahesh18 · ‎11-17-2012

Hi Abzal,

Any idea which ios version i should upgrade?

Also i have 3750 switch i will test on it later today and will update you.

Thanks for the help

MAhesh

Abzal · ‎11-17-2012

Here is my output

XXXX#sh ver

Cisco IOS Software, C3750E Software (C3750E-UNIVERSALK9-M), Version 12.2(53)SE2,

RELEASE SOFTWARE (fc3)

Technical Support: http://www.cisco.com/techsupport

Compiled Wed 21-Apr-10 05:11 by prod_rel_team

Image text-base: 0x00003000, data-base: 0x02400000

ROM: Bootstrap program is C3750E boot loader

BOOTLDR: C3750E Boot Loader (C3750X-HBOOT-M) Version 12.2(53r)SE1, RELEASE SOFTW

ARE (fc1)

XXXXX uptime is 8 weeks, 2 days, 10 hours, 9 minutes

System returned to ROM by power-on

System image file is "flash:/c3750e-universalk9-mz.122-53.SE2/c3750e-universalk9

-mz.122-53.SE2.bin"