There is another very useful way to filter MAC addresses. Instead of typing in a MAC address manually, you can use the “sticky” command. With this command, switch will learn the first MAC address connected to the interface and save it for port s. There is another very useful way to filter MAC addresses. Instead of typing in a MAC address manually, you can use the “sticky” command. With this command, switch will learn the first MAC address connected to the interface and save it for port security. First you have to remove the existing command (if you have configured manual MAC filtering): Tes. Below is an example of Port Security where only one MAC address is allowed on interface g0/1. TestSwitch(config)#int g0/1 TestSwitch(config-if)#switchport mode access TestSwitch(config-if)#switchport port-security TestSwitch(config-if)#switchport port-security maximum 1 Now, interface g0/1 is allowed to learn only one MAC address. If this interface. Besides setting a maximum limit on the number of MAC addresses, you can also use port security to filter MAC addresses. In the following example I configured port security so it only allows MAC address f1d3.2c9f.abdc.ccbato connect to the specific port of the switch. TestSwitch(config)#int g0/1 TestSwitch(config-if)#switchport mode access TestSwitc. You can see the switch ports which have entered into error-disabled state (because of security violation) with the following command: TestSwitch#show int status err-disabled Port Name Status Reason Err-disabled Vlans Gi0/1 err-disabled psecure-violation You can also verify this with show “interface g0/1 command” TestSwitch#sh int g0/1 GigabitEthern. You can also set an automatic recovery on a switch-port with the following commands: TestSwitch(config)#errdisable recovery cause psecure-violation TestSwitch(config)#interface g0/1 TestSwitch(config-if)#switchport port-security aging time 15 After 15 minutes the interface g0/1 will automatically recover from err-disable state. Make sure in these 1.