n is given of this occurrence. Restrict When a violation occurs, the switch will drop any packets from MAC addresses that do not meet the configured requirements. An SNMP trap is generated, the log is appended, and the violation counter is incremented. Shutdown When a violation occurs, the switch will put the port into the error-disabled state. This action stops all traffic from entering and exiting the port. This action is the default behavior for port-security-enabled ports. To recover from this condition, reset the interface using either the shutdown and no shutdown commands, or the errdisable recovery cause psecure-violation command. To change the port-security violation behavior, use the switchport port-security violation command: (config-: if) #switchport port-security violation ? protect Security violation protect mode restrict Security violation restrict mode shutdown Security violation shutdown mode Secure MAC addresses can be aged out based on either an absolute time or the time for which the addresses have been inactive. The latter option can be useful in dynamic environments, where there may be many devices connecting and disconnecting re- peatedly. Say you have a room full of consultants. The first three to connect in the morning get to use the network, and the rest are out of luck. If one of the original three leaves early, you may want to free up his spot to allow someone else to use the network. Alternately, you may wish to ensure that only the first three consultants to connect can use the network for the entire day, regardless of what time they leave. This would penalize the rest of the consultants for being late. I've worked with execs who would love to be able to implement such a design to get consultants to come in early! To configure the type of aging employed, use the switchport port-security aging type command: (config-if) #switchport port-security aging type ? absolute Absolute aging (default) inactivity Aging based on inactivity time period The aging time is set in minutes with the time 