 violation mode Here, I'm configuring the interface to accept packets only from the MAC address 1234.5678.9012: 3750(config-if)#switchport port-security mac-address 1234.5678.9012 You might think you can run the same command to add another MAC address to the permitted device list, but when you do this, you'll get an error: 50(config-if)#switchport port-security nac-address 1234.5678.1111 Total secure mac-addresses on interface GigabitEthernet1/0/20 has reached maximum limit. By default, only one MAC address can be entered. To increase the limit, use the switch port port-security maximum command. Once you've increased the maximum, you can add another MAC address: o(config-if)#switchport port-security maximum 2 3750(config-if)# switchport port-security mac-address 1234.5678.1111 If you try to set the maximum to a number less than the number of secure MAC addresses already configured, you will get an error and the com- mand will be ignored. You can also enter the switchport port-security maximum command without specifying any MAC addresses. By doing this, you will allow a finite number of MAC addresses to use the port. For example, with a maximum of three, the first three learned MAC addresses will be allowed, while all others will be denied. If you need the switch to discover MAC addresses and save them, use the sticky key- word. Sticky addresses are added to the running configuration: 3750(config-if)#switchport port-security mac-address sticky For the addresses to be retained, you must copy the running configu- ration to the startup configuration (or use the command write memory) before a reboot. When you have a port configured with port security, and a packet arrives that is outside the scope of your configured limits, it's considered a violation. There are three actions the switch can perform in the event of a port-security violation: Chapter 19: Catalyst 3750 Features Protect When a violation occurs, the switch will drop any packets from MAC addresses that do not meet the configured requirements. No notificatio