port security怎么没效果

jiamuyu

Current configuration : 14892 bytes
!
version 12.1
no service pad
service timestamps debug uptime
service timestamps log uptime
no service password-encryption
!
hostname jiaoxuelou-2
!
enable secret 5 ···!
errdisable recovery cause psecure-violation
errdisable recovery interval 30
ip subnet-zero
!
ip dhcp snooping vlan 8
ip dhcp snooping
!
spanning-tree mode pvst
no spanning-tree optimize bpdu transmission
spanning-tree extend system-id
!
!
!
!
interface FastEthernet0/1
switchport access vlan 6
switchport mode access
switchport port-security
switchport port-security maximum 5
switchport port-security aging time 2
switchport port-security aging type inactivity
switchport port-security mac-address sticky
!
interface FastEthernet0/2
switchport access vlan 8
switchport mode access
switchport port-security
switchport port-security maximum 5
switchport port-security aging time 2
switchport port-security aging type inactivity
switchport port-security mac-address sticky
switchport port-security mac-address sticky 0011.5b18.a56f
!
interface FastEthernet0/3
switchport access vlan 6
switchport mode access
switchport port-security
switchport port-security maximum 5
switchport port-security aging time 2
switchport port-security aging type inactivity
switchport port-security mac-address sticky
!
interface FastEthernet0/4
switchport access vlan 6
switchport mode access
switchport port-security
switchport port-security maximum 5
switchport port-security aging time 2
switchport port-security aging type inactivity
switchport port-security mac-address sticky
switchport port-security mac-address sticky 0040.63db.1aab
!
interface FastEthernet0/5
switchport access vlan 6
switchport mode access




这是我的配置，我在其中一台计算机上用网络执法官，按理说我的端口应该shutdown掉，怎么没反应呢？mac地址数超过5的话就应该down了呀。求各味大虾帮忙分析一下！！！！不胜感激！！！！

testzz

switchport port-security violation shutdown
这个命令执行了吗？

wonderliang

楼上说得对

jk0wg

Switch(config)#Mac access-list extended MAC20
Switch(config)#permit host 0011.5b18.a56f
Switch(config)#permit any host 0011.5b18.a56f
Switch(config-if )#interface Fa0/2
Switch(config-if )#mac access-group MAC20 in


再加上这个试试

[ 本帖最后由 jk0wg 于 2006-11-3 09:35 编辑 ]

nanheyu

在使用网络执法官后你可以执行sh mac-add | include fastx/y端口看下当前该端口实际上有多少个MAC地址，对CISCO 12.1的IOS，我做过很多都是可以的