VulnTech Port security | CCNA Exam Prep

Port security limits which, and how many, devices may use an access port. It counts the source MAC addresses seen on the port; beyond the maximum, the port takes a violation action. It only works on access ports (not trunks or dynamic ports).

Command (interface)	Does
`switchport mode access`	Required first: port security needs a static access port
`switchport port-security`	Turn it on (default: 1 MAC, shutdown on violation)
`switchport port-security maximum 2`	Allow up to 2 MACs (e.g. a PC behind a phone)
`switchport port-security violation {shutdown\|restrict\|protect}`	What to do on a violation
`switchport port-security mac-address sticky`	Learn MACs and save them to the running-config
`switchport port-security mac-address H.H.H`	Pin one specific MAC

Violation modes

Mode	Drops the traffic?	Logs / counter?	Port state
shutdown (default)	Yes	Log + counter	err-disabled (down until you fix it)
restrict	Yes	Log + counter	stays up
protect	Yes	No	stays up

In NetLab

▶ SW1
SW1>enable
SW1#configure terminal
Enter configuration commands, one per line.  End with CNTL/Z.
SW1(config)#interface fa0/2
SW1(config-if)#switchport mode access
SW1(config-if)#switchport port-security
SW1(config-if)#switchport port-security maximum 2
SW1(config-if)#switchport port-security violation restrict
SW1(config-if)#switchport port-security mac-address sticky
SW1(config-if)#end
*Mar  1 00:00:09.000: %SYS-5-CONFIG_I: Configured from console by console
SW1#show port-security interface fa0/2
Port Security              : Enabled
Port Status                : Secure-up
Violation Mode             : Restrict
Aging Time                 : 0 mins
Aging Type                 : Absolute
SecureStatic Address Aging : Disabled
Maximum MAC Addresses      : 2
Total MAC Addresses        : 0
Configured MAC Addresses   : 0
Sticky MAC Addresses       : 0
Last Source Address:Vlan   : 0000.0000.0000:0
Security Violation Count   : 0
SW1#show running-config interface fa0/2
Building configuration...

Current configuration : 206 bytes
!
interface FastEthernet0/2
 switchport mode access
 switchport port-security
 switchport port-security maximum 2
 switchport port-security violation restrict
 switchport port-security mac-address sticky
end

Recovering an err-disabled port

With the default shutdown mode, a violation puts the port in err-disabled: it is down until you clear it with shutdown then no shutdown. show interfaces status err-disabled lists the stuck ports.

In NetLab

▶ SW1
SW1>enable
SW1#show port-security
Secure Port  MaxSecureAddr  CurrentAddr  SecurityViolation  Security Action
                (Count)       (Count)          (Count)
---------------------------------------------------------------------------
Fa0/2                1             0             0         Shutdown        
---------------------------------------------------------------------------
Total Addresses in System (excluding one mac per port)     : 0
Max Addresses limit in System (excluding one mac per port) : 4096
SW1#configure terminal
Enter configuration commands, one per line.  End with CNTL/Z.
SW1(config)#interface fa0/2
SW1(config-if)#shutdown
*Mar  1 00:00:05.000: %LINK-5-CHANGED: Interface FastEthernet0/2, changed state to administratively down
*Mar  1 00:00:05.000: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/2, changed state to down
SW1(config-if)#no shutdown
*Mar  1 00:00:06.000: %LINK-3-UPDOWN: Interface FastEthernet0/2, changed state to up
*Mar  1 00:00:06.000: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/2, changed state to up
SW1(config-if)#end
*Mar  1 00:00:07.000: %SYS-5-CONFIG_I: Configured from console by console

Common mistake: Port security does nothing on a dynamic (default) port. Always set switchport mode access first, or switchport port-security is rejected.