sticky 的配置是学习mac地址后与端口绑定（而且是永久绑定，除非手动清除），这样同一台设备再接其他交换机的端口时，就会进入err-disable。
以下配置，不会在端口下保存MAC地址，也就是说，一部电脑插上交换机的f0/3口后，去插f0/6口是不会出现err-disable状态的。
XYJ-C2960_11#show port-security int f0/10 | in Aging Aging Time : 1 mins Aging Type : Absolute SecureStatic Address Aging : Disabled XYJ-C2960_11(config)#int f0/10 XYJ-C2960_11(config-if)#switchport port-security XYJ-C2960_11(config-if)#switchport port-security violation shutdown XYJ-C2960_11(config-if)#switchport port-security maximum 1 XYJ-C2960_11(config-if)#do show port-s int f0/10 | in Aging Aging Time : 1 mins Aging Type : Absolute SecureStatic Address Aging : Enabled以下三条命令基本上测不出来什么实际效果，虽然有细微不同，所以有与无均可。
switchport port-security aging type inactivity | absolute switchport port-security aging time 1 switchport port-security aging static要说出确切不同，就是没有配置aging，那么mac地址被记录一次后就再也不过期了，让后如果max为3，就是说接了三台pc后，第四台就会触发errdisable。
如果说aging配置了，并且为3分钟，那么接了三台后，第四台不会触发，因为没5分钟后自动清除该表表项
XYJ-C2960_9#show port-security interface f0/23 add
Secure Mac Address Table
-----------------------------------------------------------------------------
Vlan Mac Address Type Ports Remaining Age
(mins)
---- ----------- ---- ----- -------------
11 000c.29e1.0542 SecureDynamic Fa0/23 -
11 6400.6a95.9017 SecureDynamic Fa0/23 -
-----------------------------------------------------------------------------
Total Addresses: 2
XYJ-C2960_9#conf t
Enter configuration commands, one per line. End with CNTL/Z.
XYJ-C2960_9(config)#int f0/23
XYJ-C2960_9(config-if)#switchport port-security aging time 5
XYJ-C2960_9(config-if)#end
XYJ-C2960_9#show port-security interface f0/23 ad
Secure Mac Address Table
-----------------------------------------------------------------------------
Vlan Mac Address Type Ports Remaining Age
(mins)
---- ----------- ---- ----- -------------
11 000c.29e1.0542 SecureDynamic Fa0/23 5
11 6400.6a95.9017 SecureDynamic Fa0/23 5
-----------------------------------------------------------------------------
Total Addresses: 2
因为是使用shutdown的惩罚，所以要启用自动恢复，才可以避免手动操作的麻烦
XYJ-C2960_11(config)#errdisable recovery cause psecure-violation XYJ-C2960_11(config)#errdisable recovery interval 30 XYJ-C2960_11#show errdisable recovery ErrDisable Reason Timer Status ----------------- -------------- arp-inspection Disabled bpduguard Disabled channel-misconfig (STP) Disabled dhcp-rate-limit Disabled dtp-flap Disabled gbic-invalid Disabled inline-power Disabled link-flap Disabled mac-limit Disabled loopback Disabled pagp-flap Disabled port-mode-failure Disabled pppoe-ia-rate-limit Disabled psecure-violation Enabled security-violation Disabled sfp-config-mismatch Disabled small-frame Disabled storm-control Disabled udld Disabled vmps Disabled psp Disabled Timer interval: 30 seconds Interfaces that will be enabled at the next timeout:
