Core
Access Ports
Access ports carry traffic for a single VLAN and are used to connect end devices such as PCs, printers, and APs in access mode.
What you need to know
- Default switchport mode on most modern Cisco switches is dynamic auto, negotiating via DTP.
- An access port strips VLAN tags before forwarding to the connected host; frames are untagged.
- switchport mode access disables DTP negotiation and forces the port into access mode.
- Voice VLAN can coexist with a data VLAN on the same access port using switchport voice vlan.
- Port security limits the number of MAC addresses learned on an access port and can shut it down on violation.
- The default port security violation action is shutdown (err-disabled).
- Unused access ports should be assigned to an unused VLAN and administratively shut down as a security best practice.
Configuration commands
| Command | Mode | Purpose |
|---|---|---|
| interface fastethernet 0/1 | config | Enter interface configuration mode. |
| switchport mode access | config-if | Force the port into static access mode. |
| switchport access vlan 10 | config-if | Assign the access VLAN. |
| switchport voice vlan 20 | config-if | Assign a voice VLAN for an IP phone on the same port. |
| switchport port-security | config-if | Enable port security on the interface. |
| switchport port-security maximum 2 | config-if | Limit the number of secure MAC addresses to 2. |
| switchport port-security violation restrict | config-if | Change the violation action to drop offending traffic without disabling the port. |
| switchport port-security mac-address sticky | config-if | Dynamically learn and stick MAC addresses into the running-config. |
| shutdown | config-if | Administratively disable an unused port. |
Verify it
- show interfaces fa0/1 switchport
- show port-security interface fa0/1
- show port-security address
- show mac address-table interface fa0/1
- show interfaces status
Common mistakes
- Leaving switchport mode as dynamic auto instead of setting static access mode.
- Forgetting switchport port-security before setting maximum or violation options, causing errors.
- Not clearing err-disabled state with shutdown/no shutdown after a security violation.
- Assigning the voice VLAN as the same VLAN as the data VLAN.
- Expecting port security to work without switchport mode access configured first.
Practise Access Ports in a real CLI
Generated labs, graded against the simulated network state.