CCNA online course

Switch Port Security Configuration and Verification

Learn how Cisco switch port security limits MAC addresses on access ports, including configuration, secure MAC learning, violation modes, aging, verification, and troubleshooting.

Port security is a Layer 2 switch feature that controls which source MAC addresses may use a switch interface. It is commonly deployed on user-facing access ports to limit unauthorized endpoint connections.

This lesson covers Cisco IOS configuration, static, dynamic, and sticky secure MAC addresses, violation handling, aging, verification, and recovery procedures.

Purpose of Port Security

A secure MAC address is a MAC address authorized for use on a particular switch port. Port security limits both the number and identity of secure MAC addresses that can appear on an interface.

This feature helps reduce several Layer 2 risks:

  • An unauthorized user connecting a personal computer or other endpoint to an office wall jack.
  • Users connecting unapproved hubs, small switches, or other downstream equipment.
  • Casual MAC flooding attempts that try to make a switch forward traffic more broadly.
  • Unexpected endpoint replacement or connection of more devices than the port design allows.

Port security is not a complete network-access-control system. It does not prove the identity of a user, inspect the security posture of a device, or replace physical security. Use it with appropriate VLAN design, authentication such as IEEE 802.1X or MAB, switch hardening, monitoring, and physical access controls.

Where Port Security Is Applied

Port security is normally configured on a Layer 2 access interface. In common Cisco IOS configurations, the interface must be placed in access mode before port security is enabled:

interface GigabitEthernet1/0/10
 switchport mode access
 switchport port-security

Appropriate candidates include:

  • An office port assigned to one workstation.
  • A printer port.
  • An IP phone port with a workstation connected through the phone.
  • Selected server or infrastructure connections with a known and stable MAC-address design.

Trunks, switch-to-switch links, and ports that intentionally carry many changing MAC addresses are usually unsuitable. A trunk may carry traffic for many VLANs, while a downstream switch, hypervisor, hub, docking station, or virtual machine host may legitimately present several addresses. Use VLAN and inter-VLAN design appropriately instead of applying an arbitrary MAC limit.

Maximum Secure MAC Addresses

The maximum secure MAC address count is the largest number of MAC addresses that the port may learn or accept as secure. On many Cisco IOS platforms, the default maximum is one, but verify platform-specific defaults.

Set the maximum explicitly so that the configuration documents the endpoint design:

interface GigabitEthernet1/0/10
 switchport mode access
 switchport port-security
 switchport port-security maximum 1

Use a maximum of one for a single workstation when no other device should appear. An IP phone plus a workstation generally requires a maximum of two because the phone and computer have separate MAC addresses:

interface GigabitEthernet1/0/11
 switchport mode access
 switchport port-security
 switchport port-security maximum 2

Allowing more addresses increases flexibility but also increases the number of devices that can use the port. Set the value to the smallest number justified by the design. Consider phone passthrough, virtual machines, docking stations, hubs, downstream switches, and endpoint software that creates additional interfaces before selecting the value.

Secure MAC Learning Methods

Cisco IOS supports several ways to create secure MAC entries.

Method: Static secure MAC address. How added: An administrator enters the MAC address manually. Persistence: Stored in the configuration when saved. Effort: Highest, because every endpoint must be identified and maintained. Best fit: Stable devices such as printers or tightly controlled infrastructure.

Method: Dynamic secure MAC address. How added: The switch learns the source MAC while port security is active. Persistence: Typically removed after link-state changes or reloads unless converted or retained by another supported method. Effort: Low initially. Best fit: Temporary labs or environments where relearning is acceptable.

Method: Sticky secure MAC address. How added: A learned MAC is written into the running configuration as a secure entry. Persistence: Persists across reload only after the running configuration is saved to startup configuration. Effort: Lower than manually entering every address. Best fit: Fixed office endpoints that should be learned once and then retained.

Static Secure MAC Addresses

A static entry explicitly authorizes a MAC address on an interface:

interface GigabitEthernet1/0/10
 switchport mode access
 switchport port-security
 switchport port-security maximum 1
 switchport port-security mac-address 0011.2233.4455
 switchport port-security violation restrict

Static authorization provides clear administrative control, but endpoint replacement requires a planned configuration change.

Dynamic Secure MAC Addresses

With dynamic learning, the switch learns permitted addresses until the configured maximum is reached. These entries are normally not permanent after a reload. This method is convenient for a temporary exercise, but it may not provide the persistence expected in production.

Sticky Secure MAC Addresses

Sticky learning converts learned addresses into entries in the running configuration:

interface GigabitEthernet1/0/10
 switchport mode access
 switchport port-security
 switchport port-security maximum 1
 switchport port-security mac-address sticky
 switchport port-security violation shutdown

After the expected endpoint has connected and its MAC has been learned, save the configuration if the entry must survive a reload:

copy running-config startup-config

Saving is essential because the running configuration and startup configuration are separate. Confirm platform behavior when using sticky addresses, especially with reloads, aging, and software upgrades.

Violation Handling

A port-security violation occurs when a frame arrives with an unauthorized source MAC address or when the configured secure-address limit is exceeded. The violation mode determines what the switch does next.

Mode: Protect. Offending frames: Dropped silently. Port state: Remains operational for permitted traffic. Counter and notification: Does not provide the normal violation reporting behavior associated with restrict mode. Typical use: Environments prioritizing quiet enforcement, with external monitoring available.

Mode: Restrict. Offending frames: Dropped. Port state: Remains operational for authorized traffic. Counter and notification: Violation information and counters are retained, and logging behavior is more useful for monitoring than protect. Typical use: User ports where legitimate connectivity should continue while unauthorized traffic is recorded.

Mode: Shutdown. Offending frames: Dropped as the interface is disabled. Port state: Becomes err-disabled. Counter and notification: Provides the strongest operational signal and normally generates a log message. Typical use: Strictly controlled ports where an unexpected device should immediately stop port operation.

Shutdown is commonly the default violation mode on supported Cisco IOS switches, but verify the actual default. Restrict is often useful for phone-plus-workstation ports when service continuity matters. Protect is less useful when administrators need clear evidence of repeated violations.

MAC Aging

MAC aging removes a learned secure MAC address after a configured period. Aging is useful where devices are regularly replaced, moved, or shared. Without aging, a port may remain authorized for an old endpoint indefinitely.

Aging type: Absolute. Removal condition: The secure address is removed after the configured time, whether or not it is active. Suitable environment: Controlled temporary or rotating endpoint deployments. Caution: An active device may need to relearn after expiration.

Aging type: Inactivity. Removal condition: The address is removed after no qualifying activity for the configured time. Suitable environment: Shared or intermittent endpoint connections. Caution: An endpoint that is quiet for a long time may be removed and later trigger a violation or relearning event.

Example inactivity-aging configuration:

interface GigabitEthernet1/0/10
 switchport port-security aging time 30
 switchport port-security aging type inactivity

Platform and IOS behavior can differ for static, dynamic, and sticky entries. In particular, static or sticky entries may not age in the same way as dynamically learned entries. Verify the command reference and test the intended behavior before using aging in production.

Cisco IOS Configuration Workflow

  1. Select the correct target interface.
  2. Confirm that the port should be a Layer 2 access port.
  3. Set switchport mode access.
  4. Enable switchport port-security.
  5. Set the maximum secure MAC count based on the endpoint design.
  6. Choose static, dynamic, or sticky learning.
  7. Select protect, restrict, or shutdown violation handling.
  8. Optionally configure aging.
  9. Connect or authorize only the intended endpoints.
  10. Verify the secure MAC table, interface state, counters, and logs.
  11. Save the configuration when learned entries must persist.
  12. Document port ownership, expected MAC addresses, maximum count, violation mode, and recovery steps.

Example: One Office Workstation

This configuration allows one learned endpoint and disables the port if a different MAC address appears:

interface GigabitEthernet1/0/10
 description Office workstation - assigned user
 switchport mode access
 switchport port-security
 switchport port-security maximum 1
 switchport port-security mac-address sticky
 switchport port-security violation shutdown

Connect the approved workstation, verify the learned address, and save the configuration.

Example: IP Phone and Workstation

This configuration allows two expected MAC addresses and keeps the port operational for the authorized devices while recording violations:

interface GigabitEthernet1/0/11
 description IP phone and workstation
 switchport mode access
 switchport port-security
 switchport port-security maximum 2
 switchport port-security mac-address sticky
 switchport port-security violation restrict

Do not increase the maximum merely to make an unexpected device work. First identify why additional MAC addresses are present.

Verification and Monitoring

Use several commands because no single output gives the complete picture.

Command: show port-security interface GigabitEthernet1/0/10. Information: Port-security state, configured maximum, current secure-MAC count, violation mode, and violation counter. Use: First command for a port-security summary.

Command: show port-security address. Information: Secure MAC addresses, associated ports, types, and VLAN information. Use: Find authorized, unexpected, or obsolete entries.

Command: show mac address-table interface GigabitEthernet1/0/10. Information: MAC addresses currently learned by the switch on the interface. Use: Compare general MAC learning with secure entries.

Command: show interfaces status. Information: Administrative and operational status in a compact table. Use: Quickly identify connected, disabled, or err-disabled ports.

Command: show interfaces GigabitEthernet1/0/10. Information: Detailed link state, counters, and interface conditions. Use: Investigate physical or operational problems.

Command: show running-config interface GigabitEthernet1/0/10 and show startup-config. Information: Current versus saved configuration, including sticky entries. Use: Confirm persistence across reloads.

Logs and violation counters can reveal unauthorized connection attempts. A rising counter indicates that frames from unauthorized or over-limit addresses have been observed. Compare the counter with the physical endpoint and change records rather than assuming every violation is malicious.

Violation Recovery and Troubleshooting

Err-Disabled Port

In shutdown mode, a violation normally places the interface in the err-disabled state. The switch protects the network by disabling the port, but an administrator must correct the cause and recover the interface.

  1. Check the interface and port-security status.
  2. Review the violation counter and system logs.
  3. Inspect secure MAC entries and identify the attached device.
  4. Determine whether the device is unauthorized, whether the maximum is too low, or whether a stale entry remains.
  5. Remove or replace obsolete static or sticky authorization as appropriate.
  6. Re-enable the port only after correcting the cause.
interface GigabitEthernet1/0/10
 shutdown
 no shutdown

Automatic recovery is possible:

errdisable recovery cause psecure-violation
errdisable recovery interval 300

Automatic recovery can restore service without intervention, but it may repeatedly re-enable a port while an unauthorized device remains connected. Use it only with an appropriate monitoring and response process.

Common Symptoms

  • Legitimate port is err-disabled: Check for an unexpected MAC, an exceeded maximum, or a stale static or sticky entry. Correct the authorization and cycle the interface.
  • Phone-plus-PC deployment fails: Confirm that the maximum is at least two and determine whether the phone, workstation, or an intermediary presents additional MAC addresses.
  • Sticky entries disappear after restart: Compare running and startup configurations. Save the intended running configuration and test persistence during a maintenance window.
  • Port-security command is unavailable: Confirm that the interface is a Layer 2 access switchport rather than a routed port or trunk. Check platform and IOS feature support.
  • Same user is repeatedly disconnected: Investigate MAC randomization, docking stations, virtual interfaces, downstream devices, and overly aggressive aging.

Replacing an Endpoint

When a workstation is replaced, its new MAC address may not match a static or sticky entry. Locate the old secure entry with show port-security address, remove the obsolete authorization using the platform-supported interface configuration command, and then configure the new static address or allow sticky learning to record it. Verify the result and save the configuration.

Deployment Considerations and Limitations

  • IP phones: Plan for the phone and attached workstation as separate MAC addresses. Voice VLAN behavior and phone-specific platform features may affect the design.
  • Virtual machines: A hypervisor may present several MAC addresses. A one-address limit can disrupt legitimate guests, while a large limit weakens enforcement.
  • Docking stations and hubs: These may expose multiple adapters or downstream devices.
  • Downstream switches: Avoid port security unless the number and identity of downstream devices are deliberately controlled.
  • MAC randomization: Wireless and some endpoint operating systems may periodically use different source MAC addresses, causing unexpected violations.
  • Endpoint replacement: Maintain a documented process for removing old secure entries and authorizing new hardware.
  • Authentication requirements: Use IEEE 802.1X where strong, identity-based access control is required. Port security alone authorizes a MAC address, not a person.
  • Operations: Record the owner, location, expected devices, secure MAC method, maximum, violation mode, aging policy, and recovery procedure. Apply change control to production modifications.

Exam-Relevant Notes

  • Port security is normally applied to access ports, not ordinary switch-to-switch trunks.
  • The maximum secure MAC count limits how many authorized source MAC addresses can use the interface.
  • Sticky MAC learning writes learned addresses into the running configuration.
  • Sticky entries require saving the running configuration to persist across a reload.
  • Shutdown places the interface into err-disabled; restrict and protect keep the port operational for permitted traffic.
  • Restrict drops offending frames and provides violation information; protect drops offending frames with less reporting.
  • Always distinguish the general MAC address table from the port-security secure-address table.
  • Verify platform and IOS syntax and behavior, especially for defaults, aging, and sticky entries.

Summary

Port security limits the number and identity of source MAC addresses allowed on a switch access port. A reliable deployment starts with an accurate endpoint design, uses the smallest justified MAC limit, selects an appropriate learning method and violation action, and documents recovery procedures. Verification should include secure entries, interface state, counters, logs, and both running and startup configurations.