Security
Port Security
Port security restricts the number and identity of MAC addresses allowed on an access switchport to prevent unauthorized devices and MAC flooding.
What you need to know
- Port security only works on interfaces manually configured as access ports (switchport mode access) or trunk ports, not dynamic desirable/auto ports.
- Default maximum secure MAC addresses per port is 1.
- Three violation modes: protect (drops offending traffic, no log), restrict (drops traffic, increments counter, logs), shutdown (default, err-disables the port and logs).
- Sticky secure MAC addresses (switchport port-security mac-address sticky) are dynamically learned and then saved into the running configuration.
- An err-disabled port from a security violation must be recovered manually with shutdown then no shutdown, or via errdisable recovery.
- Secure MAC addresses can be static, dynamic, or sticky, and count together toward the maximum.
- Port security must be enabled explicitly with switchport port-security after the port is set to access mode.
Configuration commands
| Command | Mode | Purpose |
|---|---|---|
| interface fa0/1 | config | Enter interface configuration mode for the access port. |
| switchport mode access | config-if | Set the port to static access mode, a prerequisite for port security. |
| switchport port-security | config-if | Enable port security on the interface. |
| switchport port-security maximum 2 | config-if | Set the maximum number of secure MAC addresses to 2. |
| switchport port-security mac-address sticky | config-if | Dynamically learn MAC addresses and add them to the running config. |
| switchport port-security mac-address 0011.2233.4455 | config-if | Statically define an allowed secure MAC address. |
| switchport port-security violation restrict | config-if | Set the violation action to drop traffic and log without disabling the port. |
| switchport port-security aging time 10 | config-if | Set the inactivity aging time for dynamic secure addresses in minutes. |
| shutdown | config-if | Administratively disable the port, used to clear an err-disabled state. |
| no shutdown | config-if | Re-enable the port after clearing an err-disabled state. |
Verify it
- show port-security
- show port-security interface fa0/1
- show port-security address
- show interfaces fa0/1 status
- show running-config interface fa0/1
Common mistakes
- Enabling port-security before setting switchport mode access, which fails on a dynamic port.
- Forgetting that the default violation mode shutdown will err-disable the port on the first violation.
- Not saving sticky addresses by failing to issue copy running-config startup-config, losing them on reload.
- Connecting a switch or hub to a port-secured interface, exceeding the maximum MAC count unintentionally.
- Forgetting to re-enable an err-disabled port with shutdown / no shutdown after fixing the cause.
Practise Port Security in a real CLI
Generated labs, graded against the simulated network state.