Configuring Port Security

All Cisco MDS 9000 Series Switches provide port security features that reject intrusion attempts and report these intrusions to the administrator.


Note

Port security is supported for Fibre Channel ports and Fibre Channel over Ethernet (FCoE) ports as fc-port-security.

This chapter includes the following sections:

About Port Security

All switches in the Cisco MDS 9000 Family provide port security features that reject intrusion attempts and report these intrusions to the administrator.

Typically, any Fibre Channel device in a SAN can attach to any SAN switch port and access SAN services based on zone membership. Port security features prevent unauthorized access to a switch port in the Cisco MDS 9000 Family in the following ways:

  • Login requests from unauthorized Fibre Channel devices (Nx ports) and switches (xE ports) are rejected.

  • All intrusion attempts are reported to the SAN administrator through system messages.

  • Configuration distribution uses the CFS infrastructure, and is limited to those switches that are CFS capable. Distribution is disabled by default.

  • Configuring the port security policy requires the ENTERPRISE_PKG license (see the Cisco MDS 9000 Family NX-OS Licensing Guide).

This section includes the following topics:

Port Security Enforcement

To enforce port security, configure the devices and switch port interfaces through which each device or switch is connected, and activate the configuration.

  • Use the port world wide name (pWWN) or the node world wide name (nWWN) to specify the Nx port connection for each device.
  • Use the switch world wide name (sWWN) to specify the xE port connection for each switch.

Each Nx and xE port can be configured to restrict a single port or a range of ports.

Enforcement of port security policies are done on every activation and when the port tries to come up.

The port security feature uses two databases to accept and implement configuration changes.

  • Configuration database—All configuration changes are stored in the configuration database.
  • Active database—The database currently enforced by the fabric. The port security feature requires all devices connecting to a switch to be part of the port security active database. The software uses this active database to enforce authorization.

About Auto-Learning

You can instruct the switch to automatically learn (auto-learn) the port security configurations over a specified period. This feature allows any switch in the Cisco MDS 9000 Family to automatically learn about devices and switches that connect to it. Use this feature when you activate the port security feature for the first time as it saves tedious manual configuration for each port. You must configure auto-learning on a per-VSAN basis. If enabled, devices and switches that are allowed to connect to the switch are automatically learned, even if you have not configured any port access.

When auto-learning is enabled, learning happens for the devices or interfaces that were already logged into the switch and the new devices or interfaces that need to be logged in. Learned entries on a port are cleaned up after you shut down that port if auto-learning is still enabled.

Learning does not override the existing configured port security policies. So, for example, if an interface is configured to allow a specific pWWN, then auto-learning will not add a new entry to allow any other pWWN on that interface. All other pWWNs will be blocked even in auto-learning mode.

No entries are learned for a port in the shutdown state.

When you activate the port security feature, auto-learning is also automatically enabled.


Note
If you activate port security feature, auto-learning gets enabled by default. You cannot re-activate port security until auto-learning is disabled or deactivate and activate again.

Port Security Activation

By default, the port security feature is not activated in any switch in the Cisco MDS 9000 Family.

By activating the port security feature, the following apply:

  • Auto-learning is also automatically enabled, which means:
    • From this point, auto-learning happens for the devices or interfaces that were already logged into the switch and also for the new devices will login in future.
    • You cannot activate the database until you disable auto-learning.
  • All the devices that are already logged in are learned and are added to the active database.
  • All entries in the configured database are copied to the active database.

After the database is activated, subsequent device login is subject to the activated port bound WWN pairs, excluding the auto-learned entries. You must disable auto-learning before the auto-learned entries become activated.

When you activate the port security feature, auto-learning is also automatically enabled. You can choose to activate the port security feature and disable auto-learning.


Tip

If a port is shut down because of a denied login attempt, and you subsequently configure the database to allow that login, the port does not come up automatically. You must explicitly issue a no shutdown CLI command to bring that port back online.

Port Security Configuration

The steps to configure port security depend on which features you are using. Auto-learning works differently if you are using CFS distribution.

This section includes the following topics:

Configuring Port Security with Auto-Learning and CFS Distribution

To configure port security, using auto-learning and CFS distribution, follow these steps:

Procedure

Step 1

Enable port security. See the Enabling Port Security.

Step 2

Enable CFS distribution. See the Enabling Distribution.

Step 3

Activate port security on each VSAN. This turns on auto-learning by default. See the Activating Port Security.

Step 4

Issue a CFS commit to copy this configuration to all switches in the fabric. See the Committing the Changes. At this point, all switches are activated, and auto-learning.

Step 5

Wait until all switches and all hosts are automatically learned.

Step 6

Disable auto-learn on each VSAN. See the Disabling Auto-learning.

Step 7

Issue a CFS commit to copy this configuration to all switches in the fabric. See the Committing the Changes. At this point, the auto-learned entries from every switch are combined into a static active database that is distributed to all switches.

Step 8

Copy the active database to the configure database on each VSAN. See the Copying the Port Security Database.

Step 9

Issue a CFS commit to copy this configuration to all switches in the fabric. See the Committing the Changes. This ensures that the configure database is the same on all switches in the fabric.

Step 10

Copy the running configuration to the startup configuration, using the fabric option. This saves the port security configure database to the startup configuration on all switches in the fabric.

Configuring Port Security with Auto-Learning without CFS

To configure port security using auto-learning without CFS, follow these steps:

Procedure

Step 1

Enable port security. See the Enabling Port Security.

Step 2

Activate port security on each VSAN. This turns on auto-learning by default. See the Activating Port Security.

Step 3

Wait until all switches and all hosts are automatically learned.

Step 4

Disable auto-learn on each VSAN. See the Disabling Auto-learning.

Step 5

Copy the active database to the configure database on each VSAN. See the Copying the Port Security Database.

Step 6

Copy the running configuration to the startup configuration This saves the port security configure database to the startup configuration.

Step 7

Repeat Step 1 through Step 6 for all switches in the fabric.

Configuring Port Security with Manual Database Configuration

To configure port security and manually configure the port security database, follow these steps:

Procedure

Step 1

Enable port security. See the Enabling Port Security.

Step 2

Manually configure all port security entries into the configure database on each VSAN. See the Port Security Manual Configuration.

Step 3

Activate port security on each VSAN. This turns on auto-learning by default. See the Activating Port Security.

Step 4

Disable auto-learn on each VSAN. See the Disabling Auto-learning.

Step 5

Copy the running configuration to the startup configuration This saves the port security configure database to the startup configuration.

Step 6

Repeat Step 1 through Step 5 for all switches in the fabric.

Enabling Port Security

By default, the port security feature is disabled in all switches in the Cisco MDS 9000 Family.

To enable port security, follow these steps:

Procedure

Step 1

switch# configure terminal

Enters configuration mode.

Step 2

switch(config)# feature port-security

Enables port security on that switch.

Step 3

switch(config)# no feature port-security

(Optional) Disables (default) port security on that switch.

Port Security Activation

This section includes the following topics:

Activating Port Security

To activate the port security feature, follow these steps:

Procedure

Step 1

switch# configure terminal

switch(config)#

Enters configuration mode.

Step 2

switch(config)# port-security activate vsan 1

Activates the port security database for the specified VSAN, and automatically enables auto-learning.

Step 3

switch(config)# port-security activate vsan 1 no-auto-learn

Activates the port security database for the specified VSAN, and disables auto-learning.

Step 4

switch(config)# no port-security activate vsan 1

(Optional) Deactivates the port security database for the specified VSAN, and automatically disables auto-learning.

Example


Note

If required, you can disable auto-learning (see the Disabling Auto-learning)

Database Activation Rejection

Database activation is rejected in the following cases:

  • Missing or conflicting entries exist in the configuration database but not in the active database.
  • The auto-learning feature was enabled before the activation. To reactivate a database in this state, disable auto-learning.
  • The exact security is not configured for each PortChannel member.
  • The configured database is empty but the active database is not.

If the database activation is rejected due to one or more conflicts listed in the previous section, you may decide to proceed by forcing the port security activation.

Forcing Port Security Activation

If the port security activation request is rejected, you can force the activation.


Note
An activation using the force option can log out existing devices if they violate the active database.

You can view missing or conflicting entries using the port-security database diff active vsan command in EXEC mode.

To forcefully activate the port security database, follow these steps:

Procedure

Step 1

switch# configure terminal

switch(config)#

Enters configuration mode.

Step 2

switch(config)# port-security activate vsan 1 force

Forces the VSAN 1 port security database to activate despite conflicts.

Database Reactivation

To reactivate the port security database, follow these steps:

Procedure

Step 1

switch# configure terminal

switch(config)#

Enters configuration mode.

Step 2

switch(config)# no port-security auto-learn vsan 1

Disables auto-learning and stops the switch from learning about new devices accessing the switch. Enforces the database contents based on the devices learned up to this point.

Step 3

switch(config)# exit 

switch# port-security database copy vsan 1

Copies from the active to the configured database.

Step 4

switch# configure terminal 

switch(config)# port-security activate vsan 1

Activates the port security database for the specified VSAN, and automatically enables auto-learning.

Example


Tip

If auto-learning is enabled, and you cannot activate the database, you will not be allowed to proceed without the force option until you disable auto-learning.

Auto-learning

This section contains the following topics:

About Enabling Auto-learning

The state of the auto-learning configuration depends on the state of the port security feature:

  • If the port security feature is not activated, auto-learning is disabled by default.
  • If the port security feature is activated, auto-learning is enabled by default (unless you explicitly disabled this option).

Tip

If auto-learning is enabled on a VSAN, you can only activate the database for that VSAN by using the force option.

Enabling Auto-learning

To enable auto-learning, follow these steps:

Procedure

Step 1

switch# configure terminal

switch(config)#

Enters configuration mode.

Step 2

switch(config)# port-security auto-learn vsan 1

Enables auto-learning so the switch can learn about any device that is allowed to access VSAN 1. These devices are logged in the port security active database.

Disabling Auto-learning

To disable auto-learning, follow these steps:

Procedure

Step 1

switch# configure terminal

switch(config)#

Enters configuration mode.

Step 2

switch(config)# no port-security auto-learn vsan 1

Disables auto-learning and stops the switch from learning about new devices accessing the switch. Enforces the database contents based on the devices learned up to this point.

Auto-learning Device Authorization

The following table summarizes the authorized connection conditions for device requests.

Table 1. Authorized Auto-learning Device Requests

Condition

Device (pWWN, nWWN, sWWN)

Requests Connection to

Authorization

1

Configured with one or more switch ports

A configured switch port

Permitted

2

Any other switch port

Denied

3

Not configured

A switch port that is not configured

Permitted if auto-learning enabled

4

Denied ifauto-learning disabled

5

Configured or not configured

A switch port that allows any device

Permitted

6

Configured to log in to any switch port

Any port on the switch

Permitted

7

Not configured

A port configured with some other device

Denied

Authorization Scenarios

Assume that the port security feature is activated and the following conditions are specified in the active database:

  • A pWWN (P1) is allowed access through interface fc1/1 (F1).
  • A pWWN (P2) is allowed access through interface fc1/1 (F1).
  • A nWWN (N1) is allowed access through interface fc1/2 (F2).
  • Any WWN is allowed access through interface fc1/3 (F3).
  • A nWWN (N3) is allowed access through any interface.
  • A pWWN (P3) is allowed access through interface fc1/4 (F4).
  • A sWWN (S1) is allowed access through interface fc1/10-13 (F10 to F13).
  • A pWWN (P10) is allowed access through interface fc1/11 (F11).

The following table summarizes the port security authorization results for this active database. The conditions listed refer to the conditions mentioned in Authorized Auto-learning Device Requests table.

Table 2. Authorization Results for Scenario

Device Connection Request

Authorization

Condition

Reason

P1, N2, F1

Permitted

1

No conflict.

P2, N2, F1

Permitted

1

No conflict.

P3, N2, F1

Denied

2

F1 is bound to P1/P2.

P1, N3, F1

Permitted

6

Wildcard match for N3.

P1, N1, F3

Permitted

5

Wildcard match for F3.

P1, N4, F5

Denied

2

P1 is bound to F1.

P5, N1, F5

Denied

2

N1 is only allowed on F2.

P3, N3, F4

Permitted

1

No conflict.

S1, F10

Permitted

1

No conflict.

S2, F11

Denied

7

P10 is bound to F11.

P4, N4, F5 (auto-learning on)

Permitted

3

No conflict.

P4, N4, F5(auto-learning off)

Denied

4

No match.

S3, F5 (auto-learning on)

Permitted

3

No conflict.

S3, F5 (auto-learning off)

Denied

4

No match.

P1, N1, F6 (auto-learning on)

Denied

2

P1 is bound to F1.

P5, N5, F1 (auto-learning on)

Denied

7

Only P1 and P2 bound to F1.

S3, F4 (auto-learning on)

Denied

7

P3 paired with F4.

S1, F3 (auto-learning on)

Permitted

5

No conflict.

P5, N3, F3

Permitted

6

Wildcard ( * ) match for F3 and N3.

P7, N3, F9

Permitted

6

Wildcard ( * ) match for N3.

Port Security Manual Configuration

To configure port security on any switch in the Cisco MDS 9000 Family, follow these steps:

Procedure

Step 1

Identify the WWN of the ports that need to be secured.

Step 2

Secure the fWWN to an authorized nWWN or pWWN.

Step 3

Activate the port security database.

Step 4

Verify your configuration.

Example

This section includes the following topics:

About WWN Identification

If you decide to manually configure port security, be sure to adhere to the following guidelines:

  • Identify switch ports by the interface or by the fWWN.
  • Identify devices by the pWWN or by the nWWN.
  • If an Nx port is allowed to log in to SAN switch port Fx, then that Nx port can only log in through the specified Fx port.
  • If an Nx port’s nWWN is bound to an Fx port WWN, then all pWWNs in the Nx port are implicitly paired with the Fx port.
  • TE port checking is done on each VSAN in the allowed VSAN list of the trunk port.
  • All PortChannel xE ports must be configured with the same set of WWNs in the same PortChannel.
  • E port security is implemented in the port VSAN of the E port. In this case the sWWN is used to secure authorization checks.
  • Once activated, the config database can be modified without any effect on the active database.
  • By saving the running configuration, you save the configuration database and activated entries in the active database. Learned entries in the active database are not saved.

Adding Authorized Port Pairs

To add authorized port pairs for port security, follow these steps:

Procedure

Step 1

switch# configure terminal

switch(config)#

Enters configuration mode.

Step 2

switch(config)# port-security database vsan 1

switch(config-port-security)#

Enters the port security database mode for the specified VSAN.

Step 3

switch(config)# no port-security database vsan 1

switch(config)#

(Optional) Deletes the port security configuration database from the specified VSAN.

Step 4

switch(config-port-security)# swwn 20:01:33:11:00:2a:4a:66 interface port-channel 5

Configures the specified sWWN to only log in through PortChannel 5.

Step 5

switch(config-port-security)# any-wwn interface fc1/1 - fc1/8

Configures any WWN to log in through the specified interfaces.

Step 6

switch(config-port-security)# pwwn 20:11:00:33:11:00:2a:4a fwwn 20:81:00:44:22:00:4a:9e

Configures the specified pWWN to only log in through the specified fWWN.

Step 7

switch(config-port-security)# no pwwn 20:11:00:33:11:00:2a:4a fwwn 20:81:00:44:22:00:4a:9e

(Optional) Deletes the specified pWWN configured in the previous step.

Step 8

switch(config-port-security)# nwwn 26:33:22:00:55:05:3d:4c fwwn 20:81:00:44:22:00:4a:9e

Configures the specified nWWN to log in through the specified fWWN.

Step 9

switch(config-port-security)# pwwn 20:11:33:11:00:2a:4a:66

Configures the specified pWWN to log in through any port in the fabric.

Step 10

switch(config-port-security)# pwwn 20:11:33:11:00:2a:4a:66 swwn 20:00:00:0c:85:90:3e:80

Configures the specified pWWN to log in through any interface in the specified switch.

Step 11

switch(config-port-security)# pwwn 20:11:33:11:00:2a:4a:66 swwn 20:00:00:0c:85:90:3e:80 interface fc3/1

Configures the specified pWWN to log in through the specified interface in the specified switch

Step 12

switch(config-port-security)# any-wwn interface fc3/1

Configures any WWN to log in through the specified interface in any switch.

Step 13

switch(config-port-security)# no any-wwn interface fc2/1

(Optional) Deletes the wildcard configured in the previous step.

Example

After identifying the WWN pairs that need to be bound, add those pairs to the port security database.


Tip

Remote switch binding can be specified at the local switch. To specify the remote interfaces, you can use either the fWWN or sWWN-interface combination.

Port Security Configuration Distribution

The port security feature uses the Cisco Fabric Services (CFS) infrastructure to enable efficient database management, provide a single point of configuration for the entire fabric in the VSAN, and enforce the port security policies throughout the fabric.

This section includes the following topics:

Enabling Distribution

To enable the port security distribution, follow these steps:

Procedure

Step 1

switch# configure terminal

switch(config)#

Enters configuration mode.

Step 2

switch(config)# port-security distribute

Enables distribution.

Step 3

switch(config)# no port-security distribute

(Optional) Disables distribution.

Example

For example, if you activate port security, follow up by disabling auto-learning, and commit the changes in the pending database, then the net result of your actions is the same as issuing a port-security activate vsan vsan-id no-auto-learn command.

All the configurations performed in distributed mode are stored in a pending (temporary) database. If you modify the configuration, you need to commit or discard the pending database changes to the configurations. The fabric remains locked during this period. Changes to the pending database are not reflected in the configurations until you commit the changes.


Note
Port activation or deactivation and auto-learning enable or disable do not take effect until after a CFS commit if CFS distribution is enabled. Always follow any one of these operations with a CFS commit to ensure proper configuration. See the Activation and Auto-learning Configuration Distribution.

Tip

In this case, we recommend that you perform a commit at the end of each operation: after you activate port security and after you enable auto learning.

Locking the Fabric

The first action that modifies the existing configuration creates the pending database and locks the feature in the VSAN. After you lock the fabric, the following situations apply:

  • No other user can make any configuration changes to this feature.
  • A copy of the configuration database becomes the pending database.

To display the CFS lock information, use the show cfs lock command. For more information, see the Cisco MDS 9000 Family Command Reference.

Committing the Changes

If you commit the changes made to the configurations, the configurations in the pending database are distributed to other switches. On a successful commit, the configuration change is applied throughout the fabric and the lock is released.

To commit the port security configuration changes for the specified VSAN, follow these steps:

Procedure

Step 1

switch# configure terminal

switch(config)#

Enters configuration mode.

Step 2

switch(config)# port-security commit vsan 3

Commits the port security changes in the specified VSAN.

Discarding the Changes

If you discard (terminate) the changes made to the pending database, the configuration remains unaffected and the lock is released.

To display the CFS lock information, use the show cfs lock command. For more information, see the Cisco MDS 9000 Family Command Reference.

To discard the port security configuration changes for the specified VSAN, follow these steps:

Procedure

Step 1

switch# configure terminal

switch(config)#

Enters configuration mode.

Step 2

switch(config)# port-security abort vsan 5

Discards the port security changes in the specified VSAN and clears the pending configuration database.

Activation and Auto-learning Configuration Distribution

Activation and auto-learning configurations in distributed mode are remembered as actions to be performed when you commit the changes in the pending database.

Learned entries are temporary and do not have any role in determining if a login is authorized or not. As such, learned entries do not participate in distribution. When you disable learning and commit the changes in the pending database, the learned entries become static entries in the active database and are distributed to all switches in the fabric. After the commit, the active database on all switches is identical.

If the pending database contains more than one activation and auto-learning configuration when you commit the changes, then the activation and auto-learning changes are consolidated and the behavior may change (see the following table).

Table 3. Scenarios for Activation and Auto- learning Configurations in Distributed Mode

Scenario

Actions

Distribution = OFF

Distribution = ON

A and B exist in the configuration database, activation is not done and devices C,D are logged in.

  1. You activate the port security database and enable auto-learning.

configuration database = {A,B}

active database = {A,B, C1, D*}

configuration database = {A,B}

active database = {null}

pending database = {A,B + activation to be enabled}

  1. A new entry E is added to the configuration database.

configuration database = {A,B, E}

active database = {A,B, C*, D*}

configuration database = {A,B}

active database = {null}

pending database = {A,B, E + activation to be enabled}

  1. You issue a commit.

Not applicable

configuration database = {A,B, E}

active database = {A,B, E, C*, D*}

pending database = empty

A and B exist in the configuration database, activation is not done and devices C,D are logged in.

  1. You activate the port security database and enable auto-learning.

configuration database = {A,B}

active database = {A,B, C*, D*}

configuration database = {A,B}

active database = {null}

pending database = {A,B + activation to be enabled}

  1. You disable learning.

configuration database = {A,B}

active database = {A,B, C, D}

configuration database = {A,B}

active database = {null}

pending database = {A,B + activation to be enabled +learning to be disabled}

  1. You issue a commit.

Not applicable

configuration database = {A,B}

active database = {A,B} and devices C and D are logged out. This is equal to an activation with auto-learning disabled.

pending database = empty

1 The * (asterisk):autolearned entries * (asterisk) indicates learned entries.

Tip

In this case, we recommend that you perform a commit at the end of each operation: after you activate port security and after you enable auto-learning.

Database Merge Guidelines

A database merge refers to a union of the configuration database and static (unlearned) entries in the active database.

When merging the database between two fabrics, follow these guidelines:

  • Verify that the activation status and the auto-learning status is the same in both fabrics.
  • Verify that the combined number of configurations for each VSAN in both databases does not exceed 2 K.

Caution

If you do not follow these two conditions, the merge will fail. The next distribution will forcefully synchronize the databases and the activation states in the fabric.

Database Interaction

The following table lists the differences and interaction between the active and configuration databases.

Table 4. Active and Configuration Port Security Databases

Active Database

Configuration Database

Read-only.

Read-write.

Saving the configuration only saves the activated entries. Learned entries are not saved.

Saving the configuration saves all the entries in the configuration database.

Once activated, all devices that have already logged into the VSAN are also learned and added to the active database.

Once activated, the configuration database can be modified without any effect on the active database.

You can overwrite the active database with the configured database by activating the port security database. Forcing an activation may violate the entries already configured in the active database.

You can overwrite the configuration database with the active database.


Note
You can overwrite the configuration database with the active database using the port-security database copy vsan command. The port-security database diff active vsan command in EXEC mode lists the differences between the active database and the configuration database.

This section includes the following topics:

Database Scenarios

Port Security Database Scenarios depicts various scenarios to depict the active database and the configuration database status based on port security configurations.

Figure 1. Port Security Database Scenarios

Copying the Port Security Database

Use the port-security database copy vsan command to copy from the active to the configured database. If the active database is empty, this command is not accepted. 


switch# port-security database copy vsan 1

Use the port-security database diff active vsan command to view the differences between the active database and the configuration database. This command can be used when resolving conflicts. 


switch# port-security database diff active vsan 1

Use theport-security database diff config vsan command to obtain information on the differences between the configuration database and the active database. 


switch# port-security database diff config vsan 1

Tip

We recommend that you issue the port-security database copy vsan command after disabling auto-learning. This action will ensure that the configuration database is in sync with the active database. If distribution is enabled, this command creates a temporary copy (and consequently a fabric lock) of the configuration database. If you lock the fabric, you need to commit the changes to the configuration databases in all the switches.

Deleting the Port Security Database


Tip

If the distribution is enabled, the deletion creates a copy of the database. An explicit port-security commit command is required to actually delete the database.

Use theno port-security database vsan command in configuration mode to delete the configured database for a specified VSAN 


switch(config)# no port-security database vsan 1

Cleaning the Port Security Database

Use the clear port-security statistics vsan command to clear all existing statistics from the port security database for a specified VSAN. 


switch# clear port-security statistics vsan 1

Use the clear port-security database auto-learn interface command to clear any learned entries in the active database for a specified interface within a VSAN. 


switch# clear port-security database auto-learn interface fc1/1 vsan 1

Use the clear port-security database auto-learn vsan command to clear any learned entries in the active database for the entire VSAN. 


switch# clear port-security database auto-learn vsan 1

Note
The clear port-security database auto-learn andclear port-security statistics commands are only relevant to the local switch and do not acquire locks. Also, learned entries are only local to the switch and do not participate in distribution.

Use the port-security clear vsan command to clear the pending session in the VSAN from any switch in the VSAN. 


switch# clear port-security session vsan 5

Displaying Port Security Configuration

The show port-security database commands display the configured port security information (see the following examples).

Displays the Contents of the Port Security Configuration Database 

switch# show port-security database 

---------------------------------------------------------------------------------------
VSAN    Logging-in Entity               Logging-in Point       (Interface)
----------------------------------------------------------------------------------------
1       21:00:00:e0:8b:06:d9:1d(pwwn)  20:0d:00:05:30:00:95:de(fc1/13)
1       50:06:04:82:bc:01:c3:84(pwwn)  20:0c:00:05:30:00:95:de(fc1/12)
2       20:00:00:05:30:00:95:df(swwn)  20:0c:00:05:30:00:95:de(port-channel 128) 
3       20:00:00:05:30:00:95:de(swwn)  20:01:00:05:30:00:95:de(fc1/1)
[Total 4 entries]

You can optionally specify a fWWN and a VSAN, or an interface and a VSAN in the show port-security command to view the output of the activated port security (see Displays the Port Security Configuration Database in VSAN 1 ).

Displays the Port Security Configuration Database in VSAN 1 

switch# show port-security database vsan 1

--------------------------------------------------------------------------------
Vsan   Logging-in Entity              Logging-in Point        (Interface)
--------------------------------------------------------------------------------
1                  *                  20:85:00:44:22:00:4a:9e (fc3/5)
1      20:11:00:33:11:00:2a:4a(pwwn)  20:81:00:44:22:00:4a:9e (fc3/1)
[Total 2 entries]

Displays the Activated Database

switch# show port-security database active

----------------------------------------------------------------------------------------
VSAN    Logging-in Entity               Logging-in Point     (Interface)         Learnt
----------------------------------------------------------------------------------------
1       21:00:00:e0:8b:06:d9:1d(pwwn)   20:0d:00:05:30:00:95:de(fc1/13)           Yes
1       50:06:04:82:bc:01:c3:84(pwwn)   20:0c:00:05:30:00:95:de(fc1/12)           Yes
2       20:00:00:05:30:00:95:df(swwn)   20:0c:00:05:30:00:95:de(port-channel 128) Yes
3       20:00:00:05:30:00:95:de(swwn)   20:01:00:05:30:00:95:de(fc1/1)
[Total 4 entries]

switch# show port-security pending vsan 1

Session Context for VSAN 1
---------------------------
Activation Status: Active
Auto Learn Status: On
Force activate: No
Config db modified: Yes
Activation done: Yes
Session owner: admin(2)
Session database:
--------------------------------------------------------------------------------
VSAN Logging-in Entity Logging-in Point (Interface)
--------------------------------------------------------------------------------
1 20:11:00:33:22:00:2a:4a(pwwn) 20:41:00:05:30:00:4a:1e(fc2/1)
[Total 1 entries]

switch# show port-security pending-diff vsan 1

Session Diff for VSAN: 1
-------------------------
Database will be activated
Learning will be turned ON
Database Diff:
+pwwn 20:11:00:33:22:00:2a:4a fwwn 20:41:00:05:30:00:4a:1e

The access information for each port can be individually displayed. If you specify the fWWN or interface options, all devices that are paired in the active database (at that point) with the given fWWN or the interface are displayed (see the following examples).

Displays the Wildcard fWWN Port Security in VSAN 1

switch# show port-security database fwwn 20:85:00:44:22:00:4a:9e vsan 1

Any port can login thru' this fwwn

switch# show port-security database fwwn 20:01:00:05:30:00:95:de vsan 1

20:00:00:0c:88:00:4a:e2(swwn)

Displays the Interface Port Information in VSAN 2

switch# show port-security database interface fc 1/1 vsan 2

20:00:00:0c:88:00:4a:e2(swwn)

The port security statistics are constantly updated and available at any time (see Displays the Port Security Statistics).

Displays the Port Security Statistics

switch# show port-security statistics

Statistics For VSAN: 1
------------------------
Number of pWWN permit: 2
Number of nWWN permit: 2
Number of sWWN permit: 2
Number of pWWN deny  : 0
Number of nWWN deny  : 0
Number of sWWN deny  : 0
Total Logins permitted  : 4
Total Logins denied     : 0
Statistics For VSAN: 2
------------------------
Number of pWWN permit: 0
Number of nWWN permit: 0
Number of sWWN permit: 2
Number of pWWN deny  : 0
Number of nWWN deny  : 0
Number of sWWN deny  : 0
...

To verify the status of the active database and the auto-learning configuration, use the show port-security status command (see Displays the Port Security Status).

Displays the Port Security Status

switch# show port-security status

Fabric Distribution Enabled
VSAN 1 :No Active database, learning is disabled, Session Lock Taken
VSAN 2 :No Active database, learning is disabled, Session Lock Taken
...

The show port-security command displays the previous 100 violations by default (see Displays the Violations in the Port Security Database).

Displays the Violations in the Port Security Database

switch# show port-security violations

------------------------------------------------------------------------------------------
VSAN    Interface       Logging-in Entity               Last-Time          [Repeat count]
------------------------------------------------------------------------------------------
1       fc1/13          21:00:00:e0:8b:06:d9:1d(pwwn)   Jul  9 08:32:20 2003    [20]
                        20:00:00:e0:8b:06:d9:1d(nwwn)
1       fc1/12          50:06:04:82:bc:01:c3:84(pwwn)   Jul  9 08:32:20 2003    [1]
                        50:06:04:82:bc:01:c3:84(nwwn)
2       port-channel 1  20:00:00:05:30:00:95:de(swwn)   Jul  9 08:32:40 2003    [1]
[Total 2 entries]

The show port-security command issued with the last number option displays only the specified number of entries that appear first.

Default Settings

The following table lists the default settings for all port security features in any switch.

Table 5. Default Security Settings

Parameters

Default

Auto-learn

Enabled if port security is enabled.

Port security

Disabled

Distribution

Disabled.

Note

 
Enabling distribution enables it on all VSANs in the switch.