Restrict MAC addresses that can connect to switch ports to prevent unauthorized network access and MAC flooding attacks.

*This will apply default values, as soon as port security is on, it will be applied. If other devices are plugged in, define parameters first, then use switchport port-security

Step 1: Enable port security on the interface

1
2
3
4
5

SW1>enable
SW1#configure terminal
SW1(config)#interface fastEthernet 0/5
SW1(config-if)#switchport mode access
SW1(config-if)#switchport port-security

Step 2: Configure maximum allowed MAC addresses Set the maximum number of MAC addresses allowed on this port. Default is 1.

1

SW1(config-if)#switchport port-security maximum 2

Step 3: Define allowed MAC addresses (optional) You can manually specify which MAC addresses are allowed, or let the switch learn them dynamically. Sticky will learn whatever the maximum allowed is, then keep them statically assigned with no more.

1
2

SW1(config-if)#switchport port-security mac-address 0050.7966.6800
SW1(config-if)#switchport port-security mac-address sticky

Step 4: Set violation action Configure what happens when a security violation occurs (shutdown, restrict, or protect).

1
2
3
4

SW1(config-if)#switchport port-security violation shutdown
SW1(config-if)#no shutdown
SW1(config-if)#exit
SW1(config)#end

Step 5: Apply to multiple ports (bulk configuration)

1
2
3
4
5
6
7
8

SW1#configure terminal
SW1(config)#interface range fastEthernet 0/1-24
SW1(config-if-range)#switchport mode access
SW1(config-if-range)#switchport port-security
SW1(config-if-range)#switchport port-security maximum 1
SW1(config-if-range)#switchport port-security violation shutdown
SW1(config-if-range)#switchport port-security mac-address sticky
SW1(config-if-range)#exit

Step 6: Verify port security configuration

1
2
3

SW1#show port-security
SW1#show port-security interface fastEthernet 0/5
SW1#show port-security address

Step 7: Recover from security violation (if needed) If a port goes into err-disabled state due to violation, you’ll need to manually recover it.

1
2
3
4
5

SW1#configure terminal
SW1(config)#interface fastEthernet 0/5
SW1(config-if)#shutdown
SW1(config-if)#no shutdown
SW1(config-if)#exit

Key Points:

• Sticky learning saves learned MAC addresses to running config
• Shutdown violation puts port in err-disabled state - requires manual recovery
• Restrict violation drops violating frames but keeps port up
• Protect violation silently drops violating frames
• Only works on access ports, not trunk ports
• Use errdisable recovery cause psecure-violation for automatic recovery