Configuring secure MAC addresses

Secure MAC addresses are configured or learned in autoLearn mode. If the secure MAC addresses are saved, they can survive a device reboot. You can bind a secure MAC address only to one port in a VLAN.

Secure MAC addresses include static, sticky, and dynamic secure MAC addresses.

Table 16: Comparison of static, sticky, and dynamic secure MAC addresses

Type	Address sources	Aging mechanism	Can be saved and survive a device reboot?
Static	Manually added (by using the port-security mac-address security command without the sticky keyword).	Not available. The static secure MAC addresses never age out unless you perform any of the following tasks: Manually remove these MAC addresses. Change the port security mode. Disable the port security feature.	Yes.
Sticky	Manually added (by using the port-security mac-address security command with the sticky keyword). Converted from dynamic secure MAC addresses. Automatically learned when the dynamic secure MAC feature is disabled.	By default, sticky MAC addresses do not age out. However, you can configure an aging timer or use the aging timer together with the inactivity aging feature to remove old sticky MAC addresses. If only the aging timer is configured, the aging timer counts up regardless of whether traffic data has been sent from the sticky MAC addresses. If both the aging timer and the inactivity aging feature are configured, the aging timer restarts once traffic data is detected from the sticky MAC addresses.	Yes. The secure MAC aging timer restarts at a reboot.
Dynamic	Converted from sticky MAC addresses. Automatically learned after the dynamic secure MAC feature is enabled.	Same as sticky MAC addresses.	No. All dynamic secure MAC addresses are lost at reboot.

Type

Address sources

Aging mechanism

Can be saved and survive a device reboot?

Static

Manually added (by using the port-security mac-address security command without the sticky keyword).

Not available.

The static secure MAC addresses never age out unless you perform any of the following tasks:

Manually remove these MAC addresses.
Change the port security mode.
Disable the port security feature.

Yes.

Sticky

Manually added (by using the port-security mac-address security command with the sticky keyword).
Converted from dynamic secure MAC addresses.
Automatically learned when the dynamic secure MAC feature is disabled.

By default, sticky MAC addresses do not age out. However, you can configure an aging timer or use the aging timer together with the inactivity aging feature to remove old sticky MAC addresses.

If only the aging timer is configured, the aging timer counts up regardless of whether traffic data has been sent from the sticky MAC addresses.
If both the aging timer and the inactivity aging feature are configured, the aging timer restarts once traffic data is detected from the sticky MAC addresses.

Yes.

The secure MAC aging timer restarts at a reboot.

Dynamic

Converted from sticky MAC addresses.
Automatically learned after the dynamic secure MAC feature is enabled.

Same as sticky MAC addresses.

No.

All dynamic secure MAC addresses are lost at reboot.

When the maximum number of secure MAC address entries is reached, the port changes to secure mode. In secure mode, the port cannot add or learn any more secure MAC addresses. The port allows only frames sourced from secure MAC addresses or MAC addresses configured by using the mac-address dynamic or mac-address static command to pass through.

prev	up	next
Configuring intrusion protection	home	Configuration prerequisites