e restrict Security violation restrict mode shutdown Security violation shutdown mode Secure MAC addresses can be aged out based on either an absolute time, or the time for which the addresses have been inactive. The latter option can be useful in dynamic environments, where there may be many devices connecting and discon- necting repeatedly. Say you have a room full of consultants. The first three to connect in the morning get to use the network, and the rest are out of luck. If one of the original three leaves early, you may want to free up his spot to allow someone else to use the network. Alternately, you may wish to ensure that only the first three consultants to connect can use the network for the entire day, regardless of what time they leave. This would penalize the rest of the consultants for being late. I've worked with execs who would love to be able to implement such a design to get con- sultants to come in early! The type of aging employed is configured with the switchport port-security aging type command: 3750(config-if)# switchport port-security aging type ? absolute Absolute aging (default) inactivity Aging based on inactivity time period The aging time is set in minutes with the time keyword: 3750(config-if)# switchport port-security aging time ? <1-1440> Aging time in minutes. Enter a value between 1 and 1440 3750(config-if)# switchport port-security aging time 30 To see the status of port security, use the show port-security command. This com- mand shows a nice summary of all ports on which port security is enabled, how many addresses are configured for them, how many have been discovered, and how many violations have occurred: 3750# sho port-security Secure Port MaxSecureAddr CurrentAddr SecurityViolation Security Action (Count) (Count) (Count) Gi1/0/20 Shutdown Total Addresses in System (excluding one mac per port) Max Addresses limit in System (excluding one mac per port) : 6272 Chapter 18: Catalyst 3750 Features For more detail, use the show port-security interface command for a specific in