number of secure MAC addresses already configured, you will get an error, and the command will be ignored. You can also enter the switchport port-security maximum command without specify- ing any MAC addresses. By doing this, you will allow a finite number of MAC addresses to use the port. For example, with a maximum of three, the first three learned MAC addresses will be allowed, while all others will be denied. If you need the switch to discover MAC addresses and save them, use the sticky key- word. Sticky addresses are added to the running configuration: 3750(config-if)# switchport port-security mac-address sticky In order for the addresses to be retained, you must copy the running configuration to the startup configuration (or use the command write memory) before a reboot. When you have a port configured with port security, and a packet arrives that is out- side the scope of your configured limits, a violation is considered to have occurred. There are three actions the switch can perform in the event of a port-security violation: protect When a violation occurs, the switch will drop any packets from MAC addresses that do not meet the configured requirements. No notification is given of this occurrence. restrict When a violation occurs, the switch will drop any packets from MAC addresses that do not meet the configured requirements. An SNMP trap is generated, the log is appended, and the violation counter is incremented. Port Security shutdown When a violation occurs, the switch will put the port into the error-disabled state. This action stops all traffic from entering and exiting the port. This action is the default behavior for port-security-enabled ports. To recover from this con- dition, reset the interface using either the shutdown and no shutdown commands, or the errdisable recovery cause psecure-violation command. To change the port-security violation behavior, use the switchport port-security violation command: 750(config-if)# switchport port-security violation ? protect Security violation protect mod