To enforce port security, configure the devices and switch port interfaces through which each device or switch is connected, and activate the configuration.

• Use the port world wide name (pWWN) or the node world wide name (nWWN) to specify the N port connection for each device.

• Use the switch world wide name (sWWN) to specify the xE port connection for each switch.

Each N and xE port can be configured to restrict a single port or a range of ports.

Enforcement of port security policies are done on every activation and when the port tries to come up.

The port security feature uses two databases to accept and implement configuration changes.

• Configuration database—All configuration changes are stored in the configuration database.

• Active database—The database currently enforced by the fabric. The port security feature requires all devices connecting to a switch to be part of the port security active database. The software uses this active database to enforce authorization.

You can instruct the switch to automatically learn (auto-learn) the port security configurations over a specified period. This feature allows the switch to automatically learn about devices and switches that connect to it. Use this feature when you activate the port security feature for the first time beacuse it saves tedious manual configuration for each port. You must configure auto-learning per VSAN basis. If enabled, devices and switches that are allowed to connect to the switch are automatically learned, even if you have not configured any port access.

When auto-learning is enabled, learning occurs only for the devices or interfaces that were not already logged into the switch. Learned entries on a port are cleaned up after you shut down that port if auto-learning is still enabled.

Learning does not override the existing configured port security policies. For example, if an interface is configured to allow a specific pWWN, auto-learning does not add a new entry to allow any other pWWN on that interface. All other pWWNs are blocked even in auto-learning mode.

No entries are learned for a port in the shutdown state.

When you activate the port security feature, auto-learning is also automatically enabled.

Note	If you enable auto-learning before activating port security, you cannot activate port security until auto-learning is disabled.

By default, the port security feature is not activated.

When you activate the port security feature, the following operations occur:

• Auto-learning is also automatically enabled, which means the following:

  • From this point, auto-learning occurs only for the devices or interfaces that were not logged into the switch.

  • You cannot activate the database until you disable auto-learning.

• All the devices that are already logged in are learned and are added to the active database.

• All entries in the configured database are copied to the active database.

After the database is activated, subsequent device login is subject to the activated port bound WWN pairs, excluding the auto-learned entries. You must disable auto-learning before the auto-learned entries become activated.

When you activate the port security feature, auto-learning is also automatically enabled. You can choose to activate the port security feature and disable auto-learning.

If a port is shut down because of a denied login attempt, and you subsequently configure the database to allow that login, the port does not come up automatically. You must explicitly enter the no shutdown command to bring that port back online.

The WWN Identification has the following configuration guidelines and limitations:

• Identify switch ports by the interface or by the fWWN.

• Identify devices by the pWWN or by the nWWN.

• If an N port is allowed to log in to a SAN switch port F, that N port can only log in through the specified F port.

• If an N port’s nWWN is bound to an F port WWN, all pWWNs in the N port are implicitly paired with the F port.

• TE port checking is done on each VSAN in the allowed VSAN list of the VSAN trunk port.

• You must configure all port channel xE ports with the same set of WWNs in the same SAN port channel.

• E port security is implemented in the port VSAN of the E port. In this case, the sWWN is used to secure authorization checks.

• Once activated, you can modify the configuration database without any effect on the active database.

• By saving the running configuration, you save the configuration database and activated entries in the active database. Learned entries in the active database are not saved.

After identifying the WWN pairs that need to be bound, you can add those pairs to the port security database.

Tip	Remote switch binding can be specified at the local switch. To specify the remote interfaces, you can use either the fWWN or sWWN-interface combination.

You can enable port security distribution.

The first action that modifies the existing configuration creates the pending database and locks the feature in the VSAN. Once you lock the fabric, the following situations apply:

• No other user can make any configuration changes to this feature.

• A copy of the configuration database becomes the pending database.

You can commit the port security configuration changes for the specified VSAN.

If you commit the changes made to the configurations, the configurations in the pending database are distributed to other switches. On a successful commit, the configuration change is applied throughout the fabric and the lock is released.

You can discard the port security configuration changes for the specified VSAN.

If you discard (abort) the changes made to the pending database, the configuration remains unaffected and the lock is released.

Activation and auto-learning configurations in distributed mode are remembered as actions to be performed when you commit the changes in the pending database.

Learned entries are temporary and do not have any role in determining if a login is authorized or not. As such, learned entries do not participate in distribution. When you disable learning and commit the changes in the pending database, the learned entries become static entries in the active database and are distributed to all switches in the fabric. After the commit, the active database on all switches are identical and learning can be disabled.

If the pending database contains more than one activation and auto-learning configuration when you commit the changes, the activation and auto-learning changes are consolidated and the resulting operation may change (see the following table).

the following figure illustrates various scenarios showing the active database and the configuration database status based on port security configurations.

Figure 2. Port Security Database Scenarios

Use the port-security database copy vsan command to copy from the active to the configured database. If the active database is empty, this command is not accepted.

switch# port-security database copy vsan 1

Use the port-security database diff active vsan command to view the differences between the active database and the configuration database. This command can be used when resolving conflicts.

switch# port-security database diff active vsan 1

Use the port-security database diff config vsan command to obtain information on the differences between the configuration database and the active database:

switch# port-security database diff config vsan 1

Use the no port-security database vsan command in configuration mode to delete the configured database for a specified VSAN:

switch(config)# no port-security database vsan 1

Use the clear port-security statistics vsan command to clear all existing statistics from the port security database for a specified VSAN.

switch# clear port-security statistics vsan 1

Use the clear port-security database auto-learn interface command to clear any learned entries in the active database for a specified interface within a VSAN:

switch# clear port-security database auto-learn interface fc2/1 vsan 1

Use the clear port-security database auto-learn vsan command to clear any learned entries in the active database for the entire VSAN:

switch# clear port-security database auto-learn vsan 1

Note	The clear port-security database auto-learn and clear port-security statistics commands are only relevant to the local switch and do not acquire locks. Also, learned entries are only local to the switch and do not participate in distribution.

Use the port-security clear vsan command to clear the pending session in the VSAN from any switch in the VSAN:

switch# clear port-security session vsan 5