addresses are called static secure MAC addresses; dynamically learned MAC addresses are termed dynamic secure MAC addresses, and saved dynamic MAC addresses are called sticky secure MAC addresses. Port security is enabled with the switchport port-security interface command. This command can be configured only on an interface that has been set as a switchport. Trunks and interfaces that are dynamic (the default) cannot be configured with port security: 3750 (config-if)# switchport port-security Command rejected: GigabitEthernet1/0/20 is a dynamic port. If you get this error, you need to configure the port for switchport mode access before you can continue: 750(config-if)# switchport mode access 750(config-if)# switchport port-security You cannot configure port security on a port that is configured as a SPAN destination: 3750(config-if)# switchport port-security Command rejected: GigabitEthernet1/0/20 is a SPAN destination. Once you've enabled port security, you can configure your options: 3750(config-if)# switchport port-security ? aging Port-security aging commands mac-address Secure mac address maximum Max secure addresses violation Security violation mode Chapter 18: Catalyst 3750 Features Here, I'm configuring the interface to accept packets only from the MAC address 1234.5678.9012: 3750(config-if)# switchport port-security mac-address 1234.5678.901 You might think that you can run the same command to add another MAC address to the permitted device list, but when you do this, you'll get an error: 750(config-if)# switchport port-security mac-address 1234.5678.1111 Total secure mac-addresses on interface GigabitEthernet1/0/20 has reached maximum limit. By default, only one MAC address can be entered. To increase the limit, use the switchport port-security maximum command. Once you've increased the maximum, you can add another MAC address: 3750(config-if)# switchport port-security maximum 2 750(config-if)# switchport port-security mac-address 1234.5678.1111 If you try to set the maximum to a number less than the 