Contents

Introduction

Prerequisites

Requirements

Components Used

Conventions

Port-Based Traffic Control Overview

Configure

Network Diagram

Configuration

Verify

Related Information

Introduction

This document provides a sample configuration and verification for the port-based traffic control features on your Catalyst 3550/3560 Series Switches. Specifically, this document shows you how to configure the port-based traffic control features on a Catalyst 3550 switch.

Prerequisites

Requirements

Make sure that you meet these requirements before you attempt this configuration:

- Have basic knowledge of configuration on Cisco Catalyst 3550/3560 Series Switches.

- Have a basic understanding of port-based traffic control features.

Components Used

The information in this document is based on the Cisco Catalyst 3550 Series Switches.

The information in this document was created from the devices in a specific lab environment. All of the devices used in this document started with a cleared (default) configuration. If your network is live, make sure that you understand the potential impact of any command.

Conventions

Refer to the Cisco Technical Tips Conventions for more information on document conventions.

Port-Based Traffic Control Overview

The Catalyst 3550/3560 switch offers port-based traffic control that can be implemented in various ways:

- Storm Control

- Protected Ports

- Port Blocking

- Port Security

Storm Control prevents traffic such as a broadcast, a multicast, or a unicast storm on one of the physical interfaces of the switch. Excessive traffic in the LAN, referred to as a LAN storm, will lead to a degradation of network performance. Use storm control in order to avoid the degradation of network performance.

Storm Control observes the packets passing through an interface and determines whether the packets are unicast, multicast, or broadcast. Set the threshold level for incoming traffic. The switch counts the number of packets according to the type of packet received. If broadcast and unicast traffic exceed the threshold level on an interface, then only the traffic of a particular type is blocked. If the multicast traffic exceeds the threshold level on an interface, then all incoming traffic is blocked until the traffic level drops below the threshold level. Use the storm-control interface configuration command to configure the traffic specified storm control on the interface.

Configure Protected Ports on a switch used in a case when one neighbor should not see the traffic generated by another neighbor, so that some application traffic will not be forwarded between ports on the same switch. In a switch, Protected Ports does not forward any traffic (unicast, multicast, or broadcast) to any other protected ports, but a Protected Port can forward any traffic to non-protected ports. Use the switchport protected interface configuration command on an interface to isolate the traffic at Layer 2 from other protected ports.

Security issues can occur when unknown destination MAC addresses traffic (unicast and multicast) are flooded to all ports in the switch. In order to prevent unknown traffic being forwarded from one port to another port, configure Port Blocking, which will block unknown unicast or multicast packets. Use the switchport block interface configuration command to prevent unknown traffic being forwarded.

Use Port Security in order to restrict the input to an interface by identifying MAC addresses of the stations allowed to access the port. Assign secure MAC addresses to a secure port, so that the port does not forward packets with source addresses outside the group of defined addresses. Use sticky learning feature on an interface to convert the dynamic MAC addresses to sticky secure MAC addresses. Use the switchport port-security interface configuration command to configure the port security settings on the interface.

Configure

In this section, you are presented with the information to configure the features described in this document.

Note: Use the Command Lookup Tool (registered customers only) in order to obtain more information on the commands used in this section.

Network Diagram

This document uses this network setup:

Configuration

This document uses this configuration:

Catalyst 3550 Switch

Switch#configure terminal

Switch(config)#interface fastethernet0/3

!--- Configure the Storm control with threshold level.

Switch(config-if)#storm-control unicast level 85 70

Switch(config-if)#storm-control broadcast level 30

!--- Configure the port as Protected port.

Switch(config-if)#switchport protected

!--- Configure the port to block the multicast traffic.

Switch(config-if)#switchport block multicast

!--- Configure the port security.

Switch(config-if)#switchport mode access

Switch(config-if)#switchport port-security

!--- set maximum allowed secure MAC addresses.

Switch(config-if)#switchport port-security maximum 30

!--- Enable sticky learning on the port.

Switch(config-if)#switchport port-security mac-address sticky

!--- To save the configurations in the device.

switch(config)#copy running-config startup-config

Switch(config)#exit

Verify

Use this section to confirm that your configuration works properly.

The Output Interpreter Tool (registered customers only) (OIT) supports certain show commands. Use the OIT in order to view an analysis of show command output.

Use the show interfaces [interface-id] switchport command in order to verify your entries:

For example:

Switch#show interfaces fastEthernet 0/3 switchport

Name: Fa0/3

Switchport: Enabled

Administrative Mode: static access

Operational Mode: static access

Administrative Trunking Encapsulation: negotiate

Operational Trunking Encapsulation: native

Negotiation of Trunking: Off

Access Mode VLAN: 1 (default)

Trunking Native Mode VLAN: 1 (default)

Voice VLAN: none

Administrative private-vlan host-association: none

Administrative private-vlan mapping: none

Administrative private-vlan trunk native VLAN: none

Administrative private-vlan trunk encapsulation: dot1q

Administrative private-vlan trunk normal VLANs: none

Administrative private-vlan trunk private VLANs: none

Operational private-vlan: none

Trunking VLANs Enabled: ALL

Pruning VLANs Enabled: 2-1001

Capture Mode Disabled

Capture VLANs Allowed: ALL

Protected: true

Unknown unicast blocked: disabled

Unknown multicast blocked: enabled

Appliance trust: none

Use the show storm-control [interface-id] [broadcast | multicast | unicast] command in order to verify storm control suppression levels set on the interface for specified traffic type.

For example:

Switch#show storm-control fastEthernet 0/3 unicast

Interface  Filter State   Upper        Lower        Current

---------  -------------  -----------  -----------  -----------

Fa0/3      Forwarding       85.00%       70.00%        0.00%

Switch#show storm-control fastEthernet 0/3 broadcast

Interface  Filter State   Upper        Lower        Current

---------  -------------  -----------  -----------  -----------

Fa0/3      Forwarding       30.00%       30.00%        0.00%

Switch#show storm-control fastEthernet 0/3 multicast

Interface  Filter State   Upper        Lower        Current

---------  -------------  -----------  -----------  -----------

Fa0/3      inactive        100.00%      100.00%       N/A

Use the show port-security [interface interface-id] command in order to verify port security settings for the specified interface.

For example:

Switch#show port-security interface fastEthernet 0/3

Port Security              : Enabled

Port Status                : Secure-up

Violation Mode             : Shutdown

Aging Time                 : 0 mins

Aging Type                 : Absolute

SecureStatic Address Aging : Disabled

Maximum MAC Addresses      : 30

Total MAC Addresses        : 4

Configured MAC Addresses   : 0

Sticky MAC Addresses       : 4

Last Source Address        : 0012.0077.2940

Security Violation Count   : 0

Use the show port-security [interface interface-id] address command in order to verify all secure MAC addresses configured on a specified interface.

For example:

Switch#show port-security interface fastEthernet 0/3 address

Secure Mac Address Table

-------------------------------------------------------------------

Vlan    Mac Address       Type                Ports   Remaining Age

(mins)

----    -----------       ----                -----   -------------

1    000d.65c3.0a20    SecureSticky        Fa0/3        -

1    0011.212c.0e40    SecureSticky        Fa0/3        -

1    0011.212c.0e41    SecureSticky        Fa0/3        -

1    0012.0077.2940    SecureSticky        Fa0/3        -

-------------------------------------------------------------------

Total Addresses: 4

Related Information

- Cisco Catalyst 3550 Series Switches Support Page

- Cisco Catalyst 3650 Series Switches Support Page

- Switches Product Support

- LAN Switching Technology Support

- Technical Support & Documentation - Cisco Systems