What you will learn
Secure a switch access port, learn an approved device's MAC address, deliberately trigger a violation, and compare protect, restrict and shutdown. By the end, you should be able to choose a mode based on the balance between connectivity, visibility and incident response.
What is port security?
Port security is a Layer 2 switch feature that controls which source MAC addresses may send traffic into an interface. An ordinary access port can learn many MAC addresses. A secure port limits the number of permitted addresses and can bind specific addresses to that port.
Think of a desk socket reserved for a company PC. If someone unplugs that PC and connects a different laptop, the switch sees a different source MAC. Once the allowed address has been learned and the limit reached, traffic from the replacement device triggers the configured violation action.
Count MAC addresses, not people or cables
maximum 1 permits one secure MAC address. A phone with a PC connected through it can legitimately present more than one address; an attached switch or virtualized host can present many. Plan the limit around the endpoint design. Do not apply this one-PC configuration blindly to an uplink.
Port security does not authenticate a user's identity or encrypt traffic. An attacker may spoof an allowed MAC address. Treat it as an access-edge control alongside appropriate authentication and other switch protections.
How does the switch learn approved addresses?
- Static: the administrator explicitly configures a secure MAC. Useful for a fixed, inventoried device.
- Dynamic secure: the switch learns addresses up to the limit, without adding them as sticky entries to the running configuration.
- Sticky: learned addresses become secure entries in the running configuration. After the approved device has generated traffic, save the configuration to retain those entries across a restart.
First-device risk: sticky learning trusts the first eligible source it sees. Connect and verify the approved device before leaving the port unattended. Sticky learning is a convenient enrollment method, not an identity check.
The three violation modes
For this lab, one approved MAC has already filled the port's limit. A frame arriving from a different source MAC causes a violation. The selected mode decides whether to drop just the offending traffic or disable the interface.
| Mode | Offending traffic | Approved traffic / port | Visibility | Recovery |
|---|---|---|---|---|
| Protect | Dropped | Approved traffic can continue; port stays enabled | No violation notification; counter does not increment | No port reset needed |
| Restrict | Dropped | Approved traffic can continue; port stays enabled | Counter increments; syslog and SNMP notification support | No port reset needed |
| Shutdown | Blocked as interface is disabled | All traffic stops; port becomes error-disabled | Counter increments; inspect port-security and error-disable diagnostics | Resolve cause, then recover port |
Default: shutdown is the default violation mode after port security is enabled. Log delivery, SNMP traps and some diagnostic commands depend on the switch software, logging setup and simulator support. This lab covers the three standard CCNA modes; certain platforms also offer a VLAN-specific shutdown option.
Protect — quietly drop the unexpected source
The port remains available for the learned address, but an extra source gets no access. Its main drawback is limited visibility: a failed connection can look like an ordinary cabling or IP problem.
Example and choice: in a controlled demonstration, connect an approved PC and an extra laptop through a hub. Protect lets you observe the extra laptop's traffic being discarded while the approved PC still works. Choose it only when silent enforcement is intentional and other monitoring provides the visibility you need.
Restrict — drop and report
The useful distinction is operational: you can investigate unexpected sources without taking the approved endpoint offline. This lab starts in restrict mode so you can generate traffic and observe the violation count.
Example and choice: a fixed printer port must keep the printer available if an extra device is attached through a small switch. Restrict is a reasonable choice when continued service plus evidence of the attempt matters. Notifications must still be collected and acted on.
Shutdown — stop the entire port
An unexpected source can now interrupt the approved endpoint too. Simply reconnecting the approved PC does not clear the error-disabled condition.
Example and choice: a dedicated workstation in a controlled room should be disconnected and investigated if its port sees another device. Choose shutdown when that interruption is an acceptable part of the response. Consider accidental outages and deliberate attempts to trigger a violation before choosing it for a critical endpoint.
Lab setup and addressing
Use an isolated Packet Tracer topology with a Catalyst 2960-style switch, an approved PC-A, a replacement PC-B and a test PC. All PCs use mask 255.255.255.0; no default gateway is needed for this same-subnet exercise.
| Device | Address | Connection |
|---|---|---|
| PC-A — approved | 192.168.10.10 | SW1 Fa0/1, secured, VLAN 10 |
| PC-B — replacement | 192.168.10.20 | Initially disconnected; later replaces PC-A on Fa0/1 |
| Test PC | 192.168.10.100 | SW1 Fa0/2, VLAN 10 |
Record each PC's actual MAC address from its interface details or ipconfig /all. Use those values when checking the switch; the addresses learned in your topology will differ from someone else's.
Task 1 — Configure the baseline in restrict mode
On a clean switch, create VLAN 10 and put both connections in that VLAN. Fa0/1 is the port under test; Fa0/2 is the reference connection.
Switch> enable Switch# configure terminal Switch(config)# hostname SW1 SW1(config)# vlan 10 SW1(config-vlan)# name PORT_SECURITY_LAB SW1(config-vlan)# exit SW1(config)# interface fastEthernet 0/2 SW1(config-if)# description Test-PC SW1(config-if)# switchport mode access SW1(config-if)# switchport access vlan 10 SW1(config-if)# no shutdown SW1(config-if)# exit SW1(config)# interface fastEthernet 0/1 SW1(config-if)# description Approved-PC-A SW1(config-if)# switchport mode access SW1(config-if)# switchport access vlan 10 SW1(config-if)# switchport port-security SW1(config-if)# switchport port-security maximum 1 SW1(config-if)# switchport port-security mac-address sticky SW1(config-if)# switchport port-security violation restrict SW1(config-if)# no shutdown SW1(config-if)# end
switchport mode access explicitly makes this an access port. Enabling port security activates the feature; maximum 1 sets the address limit; sticky enrolls the approved source; violation restrict selects the response. Configuring sticky alone does not learn a device until traffic arrives.
Task 2 — Enroll PC-A and verify
- Connect only PC-A to Fa0/1. From PC-A, ping
192.168.10.100. Allow the links to come up and retry if the first ping is lost during ARP resolution or spanning-tree convergence. - Confirm that the secure MAC belongs to PC-A using the commands below.
- Save only after the expected sticky address appears in the running configuration.
SW1# show port-security interface fastEthernet 0/1 SW1# show port-security address SW1# show running-config SW1# copy running-config startup-config
Expected baseline: Port Security: Enabled, Port Status: Secure-up, Violation Mode: Restrict, maximum 1 and one sticky MAC. Your output format can vary. Find the learned switchport port-security mac-address sticky entry under Fa0/1 and compare it with PC-A's MAC.
Task 3 — Trigger a restrict violation
- Record the current violation counter. Unplug PC-A and connect PC-B to the same Fa0/1 socket.
- From PC-B, repeatedly ping
192.168.10.100. - Run
show port-security interface fastEthernet 0/1again. PC-B should fail to communicate, the port should remain enabled and the violation count should increase. - Reconnect PC-A. Once the link converges, its ping should work without resetting the port.
Do not expect exactly one increment per ping: ARP and other frames can also produce violations. Use show logging where supported to inspect notifications; Packet Tracer may simulate fewer logging details than a real switch.
Task 4 — Compare protect mode
With PC-A reconnected and working, change only the violation mode:
SW1# configure terminal SW1(config)# interface fastEthernet 0/1 SW1(config-if)# switchport port-security violation protect SW1(config-if)# end
Record the counter, replace PC-A with PC-B, and repeat the ping. PC-B is still blocked, but protect does not add violation notifications or counter increments. The old restrict count may remain visible: compare before and after rather than expecting zero. Reconnect PC-A and confirm it works.
Task 5 — Test shutdown and recover the port
Restore PC-A first, then select shutdown:
SW1# configure terminal SW1(config)# interface fastEthernet 0/1 SW1(config-if)# switchport port-security violation shutdown SW1(config-if)# end
Replace PC-A with PC-B and generate traffic again. Inspect show port-security interface fastEthernet 0/1 and show interfaces status. Expect a Secure-shutdown / err-disabled indication. Reconnecting PC-A alone will not restore service.
Recovery: remove PC-B, reconnect the approved PC-A, then reset the interface. Investigate and remove the cause before enabling the port; otherwise the next offending frame can disable it again.
SW1# configure terminal SW1(config)# interface fastEthernet 0/1 SW1(config-if)# shutdown SW1(config-if)# no shutdown SW1(config-if)# end SW1# show port-security interface fastEthernet 0/1
Retest PC-A's ping. Some platforms support timed recovery with errdisable recovery cause psecure-violation; enable that only with a deliberate recovery policy because it can repeatedly reopen a port while the cause remains.
Troubleshooting and legitimate device replacement
- No sticky address: generate traffic from PC-A, verify the physical port and VLAN, and inspect the secure address table.
- New approved PC is blocked: a sticky address is not automatically forgotten just because its cable was removed. Verify authorization, shut the port, remove the specific old sticky entry using
nofollowed by its exact configuration line, then connect and enroll the replacement. Verify and save the new configuration. - Approved device unexpectedly blocked: compare its actual MAC with the configured address. Check for a previous test device, a phone/PC combination or another legitimate source exceeding the maximum.
- No connectivity even before a violation: check matching VLANs, IP addresses, masks, links and the test PC before attributing every failed ping to port security.
- Port stays down in shutdown mode: resolve the offending source and perform recovery; changing a cable is not a substitute for clearing error-disable.
Finish by setting Fa0/1 back to switchport port-security violation restrict, verifying PC-A, and saving the configuration. The downloadable SW1 script supplies this baseline; perform the mode changes above one at a time.
Check your understanding
- A second MAC must be blocked while the approved device stays online, and you need evidence of the attempt. Which mode fits? Restrict.
- The port stays enabled, the new laptop fails, and the violation counter does not grow. Which mode fits? Protect.
- The interface is error-disabled and even the approved PC cannot communicate. Which mode fits? Shutdown; resolve the cause and recover the interface.
- Does sticky learning prove a device belongs to the organization? No. Verify the device before enrollment.
Continue reading: Port Security article. Technical references: Cisco Catalyst port-based traffic control guide and Cisco IOS port-security command reference.