181
Table 15 A comparison of static, sticky, and dynamic secure MAC addresses
Type Address sources Aging mechanism
Can be saved and
survive a device
reboot?
Static
Manually added (by using the
port-security mac-address
security command without the
sticky keyword).
Not available.
The static addresses never age out unless
you perform any of the following tasks:
• Manually remove these MAC
addresses.
• Change the port security mode.
• Disable the port security feature.
Yes.
Sticky
• Manually added (by using
the port-security
mac-address security
command with the sticky
keyword).
• Converted from dynamic
secure MAC addresses.
• Automatically learned
when the dynamic secure
MAC feature (port-security
mac-address dynamic) is
disabled.
By default, sticky MAC addresses do not
age out. However, you can configure an
aging timer or use the aging timer
together with the inactivity aging feature
to delete old sticky MAC addresses.
• If only the aging timer is configured,
the aging timer counts up regardless
of whether traffic data has been sent
from the sticky MAC address.
• If both the aging timer and the
inactivity aging feature are
configured, the aging timer restarts
once traffic data is detected from the
sticky MAC address.
Yes.
The secure MAC
aging timer restarts
at a reboot.
Dynamic
• Converted from sticky MAC
addresses.
• Automatically learned after
the dynamic secure MAC
feature is enabled.
Same as sticky MAC addresses.
No.
All dynamic secure
MAC addresses are
lost at reboot.
Configuration prerequisites
Before you configure secure MAC addresses, complete the following tasks:
• Enable port security.
• Set port security's limit on the number of MAC addresses on the port. Perform this task before you
enable autoLearn mode.
• Set the port security mode to autoLearn.
• Configure the port to permit packets of the specified VLAN to pass or add the port to the VLAN.
Make sure the VLAN already exists.
Configuration procedure
To configure a secure MAC address:
Ste
Command
Remarks
1. Enter system view.
system-view N/A