Lock down the access ports
Secure the three user ports on SW1 (fa0/1 - fa0/3):
- Make them static access ports.
- Turn on port security, learning MACs as sticky, with a maximum of 2.
- Use the restrict violation mode so a violation is dropped and logged but the port stays up.
How it works: this is VulnTech NetLab, a network simulator running in your browser. Click a device in the diagram to open its console and type commands, just like on real equipment (? shows help, Tab finishes a word). Click a cable to inspect it. Tasks tick themselves off as you complete them; questions are answered in the box under each task. Your work is kept if you reload; Reset starts the network over.
Solution explanation
An interface range applies all five commands to the three ports at once. With restrict, a third MAC on a port is dropped and the violation counter climbs, but the port keeps forwarding for the first two devices - unlike shutdown, which would err-disable it.
Show solution
[SW1]
enable
configure terminal
interface range fa0/1 - 3
switchport mode access
switchport port-security
switchport port-security maximum 2
switchport port-security mac-address sticky
switchport port-security violation restrict
end
show port-security