Port security
As a foundational element of network defense, Layer 2 security helps control who can access your network. One of the most important Layer 2 features is port security, which lets you control which devices are allowed to connect to specific switchports. This chapter covers the fundamentals of Port Security, including how it works, how to configure it, and how to verify it.
Understanding port security fundamentals
Port Security is a switch feature that lets you restrict access to a switchport based on the MAC address of the connected device. The main purpose is to prevent unauthorized devices from gaining network access by plugging into an unused or compromised switchport.
If an unauthorized device sends traffic, port security can respond in different ways - from dropping specific Ethernet frames to disabling the port entirely.
Image
Image Title - Port Security feature in action
Port security is built around MAC addresses. It inspects the Source MAC Address field of incoming Ethernet frames. Each switchport configured with port security keeps:
- A list of allowed MAC addresses
- A maximum number of MAC addresses that are allowed on that port
A security violation occurs when:
- A frame arrives with a source MAC address that isn’t allowed, or
- A new MAC address is learned and it would exceed the configured maximum
Key operational aspects of Port Security include:
- Per-Port Configuration: Port Security settings are applied individually to each switch interface, so you can control access port by port.
- Maximum MAC Addresses: Each port can be configured to allow a specific number of unique source MAC addresses. The default is typically one.
- MAC Address Learning: MAC addresses can be statically configured, dynamically learned, or “sticky learned.”
- Violation Actions: When a security violation occurs, the switch takes a predefined action, which can vary in severity.
Configuring port security
Configuring port security is done per interface. Before you enable port security, the interface must be configured as either an access port or a trunk port.
The Dynamic Trunking Protocol (DTP) configuration (not discussed here because it’s outside the scope of the CCNA 200-301 v1.1 exam) is not compatible with Port Security.
Here’s a breakdown of the configuration commands:
- Enable Port Security:
Enter interface configuration mode for the switchport (for example, {`interface gigabitethernet0/1`}) and enable port security:
- Configure Maximum MAC Addresses (Optional):
- Define Static MAC Addresses (Optional):
- Enable Sticky MAC Address Learning (Optional):
Image
Image Title - Screenshot of Sticky MAC address learning in the running config
- Set Violation Mode (Optional):
Port security violation modes
When a security violation occurs, port security can react in one of three ways:
-
Shutdown (Default Mode): This is the most aggressive mode. When a violation occurs, the switch immediately disables the port, placing it into an “err-disabled” state. The port stops forwarding all traffic, both legitimate and unauthorized. The switch will also generate Syslog messages.
To recover a port from an err-disabled state, a network administrator must manually shut down and then re-enable the interface (shutdown followed by no shutdown).
-
Protect Mode: In Protect mode, when a violation occurs, the switch discards the offending frames. The port remains operational and continues to forward traffic from authorized devices.
Protect mode provides minimal feedback:
- It does not generate Syslog messages
- It does not send SNMP traps
- It does not increment a violation counter
This can make troubleshooting harder because the port appears “up” but silently drops unauthorized traffic.
-
Restrict Mode: Restrict mode balances Protect and Shutdown. Like Protect mode, it discards offending frames and keeps the port operational for authorized traffic. Unlike Protect mode, Restrict mode:
- Generates syslog messages
- Sends SNMP traps
- Increments a security violation counter
This gives you visibility into unauthorized access attempts without disabling the port.
Verifying port security
After configuring Port Security, verify that it’s operating as intended. Several show commands are commonly used for verification:
-
show port-security interface [slot/number] This command provides detailed information about port security on a specific interface, including its enabled status, violation mode, maximum MAC addresses, current MAC addresses that were learned, and any security violation counts. It also shows the port’s security status (e.g., Secure-up, Secure-shutdown).
Image
Image Title - Screenshot of a sample output on a port configured with Port Security
-
show port-security: This command provides a summary of port security status across all interfaces where it is enabled, including the interface, maximum allowed addresses, current addresses, violation count, and configured action.
Image
Image Title - Screenshot of a sample output when the “show port-security” command is executed
-
show interfaces status err-disabled: Useful for checking whether an interface has entered an err-disabled state due to a port security violation.
-
show mac address-table secure: When port security is enabled, MAC addresses learned on that port are no longer shown as “dynamic” in show mac address-table dynamic output. Instead, they are treated as secure entries. This command displays MAC addresses that have been secured by port security.
-
show mac address-table static: This command lists statically configured MAC addresses, including MAC addresses manually defined with
{`switchport port-security mac-address`}and any sticky-learned MAC addresses that were saved to the startup configuration.