Cisco – Allowing a device blocked by port-security

ciscomac addressswitch

Lets say I have port security configured on a switch's ports like this:

Secure Port  MaxSecureAddr  CurrentAddr  SecurityViolation  Security Action
                (Count)       (Count)          (Count)
---------------------------------------------------------------------------
      Et0/2              1            1                  0         Shutdown
---------------------------------------------------------------------------

And also that I use sticky to allow all connected devices.

Now lets say an admin unplugs the computer that was plugged into a port and plugs in another one. The switch port shutdowns as expected. Now the admin calls and asked that the currently connected computer be allowed access. What is the proper way to allow access to that computer?

I ran sticky again on that specific interface and did a no shut, but it is still shutdown. Do I need to completely disable and re-enable port-security on that interface to allow the new device?

Edit: Well I found that running the sticky command again like i did, didn't actually change to the new MAC. so I did a no…sticky to remove the old MAC, ran the sticky command, then did a no shut. But now the interface is still shutdown and when I do a show run the new MAC isn't listed under the interfaces port-security config.

I know completely disabling and re enabling port security would do this i just wanted to know if there's a better way. the scenario I outlined for this question would be fairly common for environments with port-security configured.

Edit: OK so it looks like I had to run a "shutdown" command on the interface before the no shutdown.

So here's what my process will be for re-enabling a port for a new device:

(config-if)# shutdown
(config-if)# no switchport port-security mac-address sticky
(config-if)# switchport port-security mac-address sticky
(config-if)# no shutdown

Best Answer

If you want it to learn a new MAC and make it sticky you'll to remove the old one:
no switchport port-security mac-address mac_address in the relevant interface.

The docs here have some useful info but you might want to consult the docs your specific IOS version.

Related Topic