VMware ESXi and vSphere Cluster Management

Cisco Switch Port Security Configuration and Violation Modes

Learn how to configure Cisco switch port security, assign secure MAC addresses, choose violation modes, verify status, and recover err-disabled ports.

What Port Security Does

Switch interfaces are commonly active when a switch is installed. Anyone who can reach an unused wall jack may therefore connect a device and obtain Layer 2 access to the connected VLAN. Physical access control, such as locked wiring closets and controlled jacks, remains important.

Port security is a Cisco Layer 2 access-control feature that limits the source MAC addresses allowed to send frames through a switch interface. A permitted address is called a secure MAC address.

Port security reduces unauthorized endpoint access, but it is not a complete security solution. It does not replace authentication, VLAN design, endpoint security, access control lists, monitoring, or physical security.

Prerequisites and Operating Requirements

Before configuring port security, understand Ethernet frame forwarding, MAC address learning, Cisco IOS configuration modes, access ports, VLANs, and saving configurations.

  • Port security is configured separately on each switch interface.
  • The interface should be configured as a static access port before port security is enabled.
  • An access port carries traffic for one access VLAN and is normally used for an endpoint.
  • The port must be operationally suitable for endpoint access. Exact behavior and command support can vary by Cisco IOS platform and software release.

Use the following sequence to enter interface configuration mode and make the port an access port:

configure terminal
interface FastEthernet0/1
switchport mode access

Enable Basic Port Security

After configuring the interface as an access port, enable port security:

configure terminal
interface FastEthernet0/1
switchport mode access
switchport port-security
end

On platforms where the default applies, enabling port security permits a maximum of one secure MAC address. Explicitly configuring the maximum is recommended when the intended design should be clear:

configure terminal
interface FastEthernet0/1
switchport port-security maximum 1
end

Assigning Secure MAC Addresses

Static Secure MAC Address

A static secure MAC address is manually configured by an administrator. This is useful when a fixed device, such as a known workstation, must be bound tightly to a port.

configure terminal
interface FastEthernet0/1
switchport mode access
switchport port-security
switchport port-security mac-address 0011.2233.4455
end

Replace 0011.2233.4455 with the authorized device's actual MAC address. A static binding is explicit and predictable, but it must be changed when the device is replaced.

Sticky MAC Learning

A sticky MAC address is learned dynamically by port security from the device currently connected to the interface. The switch treats the learned address as a secure entry and displays it as a sticky entry in the active configuration.

configure terminal
interface FastEthernet0/1
switchport mode access
switchport port-security
switchport port-security mac-address sticky
end

Generate traffic from the trusted endpoint if necessary, then inspect the learned entry:

show port-security interface FastEthernet0/1
show running-config interface FastEthernet0/1

Sticky addresses can appear in the running configuration. Save the configuration after reviewing the learned address so it remains after a reload:

copy running-config startup-config

Sticky learning simplifies deployment when the initially connected device is trusted. It also creates an operational responsibility: replacing, docking, virtualizing, or moving the endpoint may require updating the sticky entry.

Static and Sticky Methods Compared

Method: Static secure MAC address

How the address is obtained: Manually entered by an administrator.

Persistence: Stored as configured data; save the overall configuration as part of normal change management.

Advantages: Precise and tightly controlled for fixed devices.

Operational risks: A device replacement or hardware change can cause violations until the old entry is updated.

Method: Sticky MAC learning

How the address is obtained: Learned from the currently attached endpoint.

Persistence: The learned entry must be saved to startup configuration to survive a reload.

Advantages: Faster deployment and less manual MAC-address entry.

Operational risks: An untrusted device connected during initial learning could become authorized; later device changes may also require cleanup.

Set the Maximum Number of Secure MAC Addresses

The maximum controls how many secure MAC addresses may use an interface. A typical single-host wall jack should normally allow one address:

configure terminal
interface FastEthernet0/1
switchport port-security maximum 1
end

A port legitimately used by an IP phone and a connected workstation may need a larger maximum. Set the smallest value that supports the design:

configure terminal
interface FastEthernet0/1
switchport port-security maximum 2
end

Allowing multiple addresses provides flexibility but expands the number of devices that can share the port. A larger maximum can also make unauthorized access harder to distinguish from legitimate use. Confirm the phone, workstation, virtualization, docking station, or downstream-device design before increasing the limit.

Violation Modes

A security violation occurs when the switch receives traffic from an unauthorized source MAC address or when the number of observed secure MAC addresses exceeds the configured maximum.

Mode: Protect

Unauthorized traffic action: Discards traffic from violating MAC addresses.

Violation counter and logging behavior: In typical IOS behavior, does not increment the violation counter or generate normal violation notification.

Interface state: Remains operational.

Typical use case: Silent blocking where minimal event visibility is acceptable.

Mode: Restrict

Unauthorized traffic action: Discards traffic from violating MAC addresses.

Violation counter and logging behavior: Increments violation counters and produces notification or logging information.

Interface state: Remains operational.

Typical use case: Blocking with useful monitoring and troubleshooting information.

Mode: Shutdown

Unauthorized traffic action: Discards the violating traffic and disables the interface.

Violation counter and logging behavior: Produces notification or logging information.

Interface state: Enters err-disabled state.

Typical use case: Strict enforcement when any unexpected source should disable service.

Shutdown is the usual default violation action on supported Cisco IOS access-port configurations, but verify the actual platform and release. Configure the desired mode explicitly when a particular policy is required.

configure terminal
interface FastEthernet0/1
switchport port-security violation protect
end
configure terminal
interface FastEthernet0/1
switchport port-security violation restrict
end
configure terminal
interface FastEthernet0/1
switchport port-security violation shutdown
end

Practical Example: One Authorized Workstation

Assume Host A is connected to FastEthernet0/1 on switch SW1, and its authorized MAC address is 0011.2233.4455. This configuration permits only that MAC address:

configure terminal
interface FastEthernet0/1
switchport mode access
switchport port-security
switchport port-security maximum 1
switchport port-security mac-address 0011.2233.4455
switchport port-security violation shutdown
end

With Host A connected, the port should operate normally. If Host A is removed and a different laptop sends traffic, the new source MAC address causes a violation. With shutdown mode, the interface enters err-disabled state.

Verification and Monitoring

Use an interface-specific command to inspect the port-security state:

show port-security interface FastEthernet0/1

Inspect the port status, configured maximum, current secure MAC count, violation count, violation mode, and secure MAC addresses. A healthy active port is commonly shown as secure-up. A configured port without an active link may show secure-down. A port disabled by shutdown-mode port security is typically shown as secure-shutdown or otherwise identified as err-disabled, depending on platform and release.

List secure addresses across the switch with:

show port-security address

Check general interface status for an err-disabled indication:

show interfaces status

Compare the normal MAC address table with port-security state when investigating unexpected learning:

show mac address-table interface FastEthernet0/1

Command: show port-security interface FastEthernet0/1

Information to inspect: Port status, maximum, secure MAC count, violation count, violation mode, and secure addresses.

Healthy result: Secure-up when linked, expected maximum and address count, and no unexpected violations.

After shutdown violation: Violation count or status indicates the event, and the port is disabled or secure-shutdown.

Command: show port-security address

Information to inspect: Secure MAC addresses, associated interfaces, VLANs, and entry types where supported.

Healthy result: Expected authorized address is associated with the correct port.

After shutdown violation: Existing secure entries can help identify what the port expected.

Command: show interfaces status

Information to inspect: Link and administrative status.

Healthy result: Connected or not-connected according to the physical condition, without err-disabled status.

After shutdown violation: Status identifies the interface as err-disabled.

Command: show mac address-table interface FastEthernet0/1

Information to inspect: MAC addresses learned in the interface's VLAN.

Healthy result: Learned addresses match the intended endpoint design.

After shutdown violation: Use the output with port-security details to compare observed and authorized devices.

Recover from a Shutdown Violation

First identify and remove the unexpected device, or confirm through change control that it is legitimate. Do not reset the port without correcting the cause, because the same device can immediately trigger another violation.

After resolving the endpoint or authorization problem, administratively reset the interface:

configure terminal
interface FastEthernet0/1
shutdown
no shutdown
end

Recheck the interface and port-security state:

show interfaces status
show port-security interface FastEthernet0/1

If a replacement device is legitimate, remove or replace the obsolete static or sticky MAC entry according to the change-control policy before reconnecting the new endpoint. Use show running-config interface FastEthernet0/1 and show port-security address to locate the old entry.

Optional Automatic Err-Disabled Recovery

Some environments permit timed recovery from port-security err-disabled events:

configure terminal
errdisable recovery cause psecure-violation
errdisable recovery interval 300
end

Confirm exact command support and defaults on the deployed Cisco IOS version. Automatic recovery should be used only when policy allows it. If the cause remains, the port can repeatedly disable and restore, potentially allowing repeated unauthorized attempts and creating an operational alert cycle.

Troubleshooting Common Problems

Port Becomes Err-Disabled After a New Device Is Connected

The likely cause is shutdown violation mode detecting an unauthorized MAC address or a secure-MAC maximum that has been exceeded.

show port-security interface FastEthernet0/1
show interfaces status

Verify the connected endpoint and its MAC address. Remove or authorize the unexpected device, adjust the secure-MAC configuration only when justified, and then perform the administrative shutdown/no shutdown recovery.

A Replacement Device Cannot Connect

A static or sticky entry may still identify the previous device as the only authorized address. Inspect:

show port-security interface FastEthernet0/1
show running-config interface FastEthernet0/1
show port-security address

Remove or replace the obsolete secure MAC entry according to policy, then validate the replacement endpoint.

An IP Phone and PC Cause Repeated Violations

The maximum may be too low for the legitimate number of source MAC addresses. Confirm that both devices are expected, inspect the secure-MAC count, and set a minimally sufficient maximum. Keep the violation mode appropriate for the required monitoring and enforcement level.

Sticky Entries Disappear After a Reboot

The learned entries were probably not saved to startup configuration. Compare:

show running-config interface FastEthernet0/1
show startup-config

After reviewing the learned addresses, save the configuration with copy running-config startup-config.

The Port-Security Command Is Rejected

The interface may not be configured as an access port, or the switch platform and IOS release may have feature limitations. Check the interface configuration and confirm feature support:

show running-config interface FastEthernet0/1

Configure the required access-port mode and verify the exact syntax for the deployed platform and release.

Design Recommendations and Exam Notes

  • Use a static secure MAC binding for tightly controlled, fixed devices.
  • Use sticky learning when the initial endpoint is trusted and simpler deployment is valuable.
  • Use one secure MAC address for a normal single-host wall jack unless the design requires more.
  • Use a larger maximum for legitimate multi-device arrangements, such as an IP phone with a connected workstation, while keeping the value as low as practical.
  • Choose protect for silent blocking, restrict for blocking plus counters and notifications, and shutdown for strict enforcement with an err-disabled response.
  • Account for legitimate MAC changes caused by hardware replacement, virtualization, docking stations, phones, and downstream devices.
  • For exam questions, remember the sequence: configure access mode, enable port security, set the maximum or secure MAC address, select the violation mode, verify, and save when sticky entries must persist.
  • Port security is per interface and is based on source MAC addresses; it is not user authentication and does not secure the entire network.