# Port Security

The `nv unset` commands remove the configuration you set with the equivalent `nv set` commands. This guide only describes an `nv unset` command if it differs from the `nv set` command.

## nv set interface <interface-id> port-security state

Enables and disables port security on an interface.

In Cumulus Linux 5.14 and earlier, you specify `enable on` or `enable off` instead of `state enabled` or `state disabled`.

### Command Syntax

Syntax | Description
--- | ---
`<interface-id>` | The interface you want to configure.

### Version History

Introduced in Cumulus Linux 5.7.0

### Example

    cumulus@switch:~$ nv set interface swp1 port-security state enabled

## nv set interface <interface-id> port-security mac-limit

Configures the maximum number of MAC addresses allowed to access the specified port. You can specify a value between 1 and 512. The default value is 32.

### Command Syntax

Syntax | Description
--- | ---
`<interface-id>` | The interface you want to configure.

### Version History

Introduced in Cumulus Linux 5.7.0

### Example

    cumulus@switch:~$ nv set interface swp1 port-security mac-limit 100

## nv set interface <interface-id> port-security static-mac

Configures specific MAC addresses allowed to access the specified port.

### Command Syntax

Syntax | Description
--- | ---
`<interface-id>` | The interface you want to configure.

### Version History

Introduced in Cumulus Linux 5.7.0

### Example

    cumulus@switch:~$ nv set interface swp1 port-security static-mac 00:02:00:00:00:05

## nv set interface <interface-id> port-security sticky-ageing

Enables (`enabled`) and disables (`disabled`) sticky MAC aging on the specified interface.

### Command Syntax

Syntax | Description
--- | ---
`<interface-id>` | The interface you want to configure.

### Version History

Introduced in Cumulus Linux 5.7.0

### Example

    cumulus@switch:~$ nv set interface swp1 port-security sticky-ageing enabled

## nv set interface <interface-id> port-security sticky-mac

Enables (`enabled`) and disables (`disabled`) sticky MAC port security to track specific dynamically learned MAC addresses on a port.

Cumulus Linux maintains learned sticky MAC addresses through interface flaps and reboots if the source MAC address is still sending traffic; otherwise learned sticky MAC addresses age out according to the sticky MAC aging time.

### Command Syntax

Syntax | Description
--- | ---
`<interface-id>` | The interface you want to configure.

### Version History

Introduced in Cumulus Linux 5.7.0

### Example

    cumulus@switch:~$ nv set interface swp1 port-security sticky-mac enabled

## nv set interface <interface-id> port-security sticky-timeout

Configures the time period after which learned sticky MAC addresses age out and no longer have access to the port. You can specify a value between 0 and 3600 minutes. The default setting is 1800 minutes.

### Command Syntax

Syntax | Description
--- | ---
`<interface-id>` | The interface you want to configure.

### Version History

Introduced in Cumulus Linux 5.7.0

### Example

    cumulus@switch:~$ nv set interface swp1 port-security sticky-timeout 20

## nv set interface <interface-id> port-security violation-mode

Configures violation mode on the specified interface to put a port into a protodown state (`protodown`) or to drop packets (`restrict`).

### Command Syntax

Syntax | Description
--- | ---
`<interface-id>` | The interface you want to configure.

### Version History

Introduced in Cumulus Linux 5.7.0

### Example

    cumulus@switch:~$ nv set interface swp1 port-security violation-mode protodown

## nv set interface <interface-id> port-security violation-timeout

Configures the number of minutes after which the violation mode times out. You can specify a value between 0 and 60 minutes. The default value is 30 minutes.

### Command Syntax

Syntax | Description
--- | ---
`<interface-id>` | The interface you want to configure.

### Version History

Introduced in Cumulus Linux 5.7.0

### Example

    cumulus@switch:~$ nv set interface swp1 port-security violation-timeout 60