Cisco Switchport Port-Security Violation Protect – Breach Limits Explained

ciscocisco-commandsmac addressport-securityswitch

The switchport port-security violation shutdown , shuts the port (err-disabled) when the policy is violated. But, for restrict and protect modes there isn't a mention of shutting a port down. So, can the policy be violated unlimited number of times when a switch port is configured with :
switchport port-security violation restrict(or protect)

Best Answer

Yes, the restrict and protect modes can be violated any number of times without shutting down the port since they are not designed to do that; they will drop packets with unknown source addresses:

See Configuring the Port Security Violation Mode on a Port on page 62-6:

  • protect—Drops packets with unknown source addresses until you remove a sufficient number of secure MAC addresses to drop below the maximum value.
  • restrict—Drops packets with unknown source addresses until you remove a sufficient number of secure MAC addresses to drop below the maximum value and causes the SecurityViolation counter to increment.
  • shutdown—Puts the interface into the error-disabled state immediately and sends an SNMP trap notification.
Related Topic