Cisco & Networking · Lesson 10
Switch Port Security
Learn how Cisco port security limits source MAC addresses on access ports, how sticky learning works, how violation modes differ, and how to recover safely when a protective response is triggered.
Port security is useful only when it matches the real endpoint design. Strong competition work means securing the port without disconnecting phones, workstations, servers, or other required devices.
Lesson Snapshot
Learning objectives
Secure access ports without guessing
Explain what Cisco switch port security is designed to control.
Distinguish maximum MAC limits, static secure MAC addresses, sticky learning, and violation modes.
Inspect existing port-security state before changing an access port.
Recognize the difference between protect, restrict, and shutdown violation behavior.
Troubleshoot port-security violations without erasing useful evidence or disabling required devices.
Apply port security only to confirmed endpoint-facing access ports and verify the result.
Core idea
Secure the expected access-port behavior
Port security works best when you already know what type of device belongs on the port, how many legitimate MAC addresses it may use, and what response should occur if something unexpected appears.
Competition warning
Maximum 1 is not a universal hardening rule
Phones, virtualization hosts, access points, and other legitimate designs can produce multiple source MAC addresses. Inspect first.
Core concepts
Six ideas behind switch port security
Port security
A Cisco switch feature that limits which source MAC addresses can use a Layer 2 access port and what happens when the configured policy is violated.
Secure MAC address
A MAC address accepted by the port-security policy, whether configured manually, learned dynamically, or learned with sticky behavior.
Maximum MAC count
The number of secure MAC addresses the switch permits on the port before a violation condition occurs.
Sticky learning
A feature that learns source MAC addresses dynamically and can place them into the running configuration as sticky secure addresses.
Violation mode
The configured response when a frame arrives from a MAC address that violates the port-security policy.
Err-disabled state
A protective state in which Cisco IOS disables a port after certain serious conditions, including port-security shutdown violations on many platforms.
Why it matters
Port security narrows who can use an access port
Limit unexpected devices
An access port intended for one workstation can be restricted so additional unauthorized MAC addresses do not automatically gain normal access.
Reduce casual port sharing
Port security can make it harder to connect an unmanaged switch or multiple unexpected endpoints behind a single access port.
Create useful evidence
Violation counters and secure-MAC state can show when a port has observed behavior outside the configured policy.
Support least privilege
The switchport can be configured for the number and type of devices the scenario actually requires.
Protect access ports
Port security is generally most appropriate on known endpoint-facing access ports, not on trunks or broad infrastructure links.
Complement other controls
Port security does not replace VLAN design, authentication, ACLs, DHCP protections, or endpoint security.
Before configuration
Confirm the port role and endpoint design first
Confirm the interface is an access port
Port security is intended for access-style endpoint links on the supported Cisco platform.
Confirm the connected device role
A workstation, phone-plus-PC combination, access point, or downstream switch may require different MAC limits.
Inspect current MAC learning
The existing MAC table helps show how many devices the port currently sees.
Check current port-security state
The feature may already be configured with a deliberate maximum, violation mode, or secure MAC list.
Document required endpoint MAC addresses if known
Static or sticky decisions should reflect the authorized environment rather than guesses.
Confirm console or alternate management access when needed
A broad switchport mistake should not lock the team out of critical management paths.
Cisco inspection
Collect evidence before changing the port
show interfaces statusReview physical status, VLAN, duplex, speed, and port role clues.
show interfaces <interface> switchportConfirm access mode and VLAN before touching port security.
show running-config interface <interface>Review the exact switchport and port-security statements already applied.
show mac address-table interface <interface>See which MAC addresses the switch has learned on the port.
show port-security interface <interface>Review port-security status, violation mode, maximum MACs, secure MAC count, and violations where supported.
show port-security addressDisplay secure MAC addresses known to port security on supported switches.
show interfaces <interface>Review detailed link state and interface counters.
show loggingLook for port-security or err-disable messages when logging is available.
Packet Tracer behavior can differ
Some simulated Cisco switch models support only part of the full port-security command set. Use the available inspection output and focus on the policy concepts, secure MAC state, and violation behavior.
Secure MAC types
Static, dynamic, and sticky do different jobs
Static secure MAC
Explicitly configured by the administrator and accepted by the port-security policy.
Strength
Predictable for known fixed endpoints.
Caution
Requires accurate MAC documentation and manual updates when hardware changes.
Dynamic secure MAC
Learned dynamically while port security is active, depending on platform behavior.
Strength
Requires less manual entry.
Caution
Dynamic entries may not persist after reload unless the design saves them another way.
Sticky secure MAC
Learned dynamically and represented as sticky secure MAC configuration.
Strength
Combines automatic learning with configuration visibility.
Caution
Review what was learned before saving so an unexpected device is not made persistent.
Violation modes
Decide what the switch should do when policy is violated
protectForwarding
Frames from violating source MAC addresses are dropped.
Evidence
Typically limited compared with restrict; behavior varies by IOS platform.
Port state
Port remains up.
Competition note
Useful to understand, but can make violations less visible if evidence is needed.
restrictForwarding
Frames from violating source MAC addresses are dropped.
Evidence
Violation counters and logging/SNMP notification may be generated depending on platform.
Port state
Port remains up.
Competition note
Often useful when you want to preserve the authorized device while still recording violations.
shutdownForwarding
Violation triggers a serious protective response.
Evidence
Violation is normally visible through port-security state and system messages.
Port state
Port commonly becomes err-disabled.
Competition note
Strong response, but a wrong MAC limit can disconnect a required endpoint and demand deliberate recovery.
Basic configuration
Inspect, constrain, and verify one confirmed access port
Confirm access mode
show interfaces GigabitEthernet0/5 switchportshow running-config interface GigabitEthernet0/5Do not enable port security on a port whose role is uncertain.
Inspect learned MAC addresses
show mac address-table interface GigabitEthernet0/5Confirm how many legitimate devices currently use the port.
Enter the access port
configure terminalinterface GigabitEthernet0/5Limit scope to the one confirmed endpoint-facing interface.
Enable port security
switchport mode accessswitchport port-securityMake the access role explicit before enabling the feature.
Set the intended maximum
switchport port-security maximum 1Use a number that matches the actual endpoint design, not a universal rule.
Select violation behavior
switchport port-security violation restrictChoose the response deliberately based on the scenario and the risk of disconnecting a required device.
Configure secure MAC behavior
switchport port-security mac-address stickyUse sticky learning only if the design calls for learning the authorized endpoint dynamically.
Exit and verify
endshow port-security interface GigabitEthernet0/5show port-security addressConfirm the policy and learned address before saving.
Controlled examples
Match the policy to the actual access-port design
Permit one known workstation MAC
Commands
configure terminalinterface GigabitEthernet0/5switchport mode accessswitchport port-securityswitchport port-security maximum 1switchport port-security mac-address 00AA.BBCC.DD01switchport port-security violation restrictendVerify
show port-security interface GigabitEthernet0/5Allow an IP phone plus workstation design
Commands
configure terminalinterface GigabitEthernet0/8switchport mode accessswitchport port-securityswitchport port-security maximum 2switchport port-security mac-address stickyswitchport port-security violation restrictendVerify
show port-security addressRemove one incorrect static secure MAC
Commands
configure terminalinterface GigabitEthernet0/5no switchport port-security mac-address 00AA.BBCC.DD99endVerify
show port-security interface GigabitEthernet0/5Maximum MAC count
Set the limit from the endpoint role, not from habit
Single workstation
Likely maximum: 1
Verify there is not also a legitimate phone, hypervisor, or bridged device behind the port.
IP phone with attached workstation
Likely maximum: Often more than 1
Voice/data designs can expose multiple legitimate source MAC addresses on one physical switchport.
Virtualization host
Likely maximum: Potentially several
A hypervisor can legitimately source traffic from multiple virtual machines.
Downstream switch
Likely maximum: Many
This may be an infrastructure link and may not be appropriate for ordinary access-port security at all.
Wireless access point
Likely maximum: Potentially many
The correct configuration depends on AP mode and network design.
Sticky learning
Learn only from a known authorized endpoint
Start from a known authorized endpoint
Do not learn sticky MAC addresses while unknown devices are connected.
Enable sticky learning
The switch learns source MAC addresses according to the port-security maximum.
Generate normal authorized traffic
Allow the legitimate endpoint to send frames so the switch can learn it.
Inspect the learned secure address
Use show port-security address and the interface running configuration.
Confirm the MAC belongs to the required endpoint
Compare with endpoint information or documented topology before saving.
Save only after validation
If sticky MAC lines are now part of running-config, saving can make those learned addresses persistent.
Violation symptoms
Use the symptom to infer the policy state
Violation counter increases but the authorized workstation still works
Likely: restrict
Identify the violating source MAC, confirm the maximum, and inspect whether an unexpected device is connected.
Unexpected device receives no traffic, but the port remains up and little evidence appears
Likely: protect
Check the secure MAC list and current learned addresses because protect can be less visible.
Port becomes err-disabled after another device is connected
Likely: shutdown
Inspect port-security status and logs before attempting recovery.
Legitimate phone-plus-PC port violates a maximum of 1
Likely: Policy mismatch
Confirm the authorized design and adjust the maximum only if the scenario really requires two legitimate MAC addresses.
Sticky secure MAC belongs to an old workstation
Likely: Stale secure address
Verify the replacement device is authorized, document the old value, and update only the affected secure-MAC configuration.
Many MAC addresses appear behind an uplink
Likely: Wrong feature placement
Confirm whether the interface is actually an infrastructure link rather than an endpoint access port.
Err-disabled recovery
Fix the cause before re-enabling the port
Preserve evidence
Record show port-security interface output, secure MAC addresses, logs, and the connected-device information before resetting anything.
Identify the cause
Confirm that port security caused the err-disabled state rather than another protection feature.
Correct the policy or endpoint problem
Remove the unauthorized device, correct a stale MAC, or adjust the maximum only if the scenario supports the change.
Recover the interface deliberately
On many IOS switches, shutdown followed by no shutdown can recover the port after the cause is corrected.
Verify secure state
Recheck port-security status, learned MAC addresses, and violation counters.
Test the required endpoint
Confirm the authorized device regains expected network access before saving.
show port-security interface GigabitEthernet0/5Confirm violation status, secure MAC count, and violation mode.
show interfaces status err-disabledList err-disabled interfaces on supported IOS platforms.
show loggingLook for the reason the port was disabled.
configure terminalEnter configuration mode only after the cause has been understood.
interface GigabitEthernet0/5Select the exact affected port.
shutdownAdministratively reset the interface as part of deliberate recovery.
no shutdownRe-enable the interface after the violation cause has been corrected.
Configuration-state reasoning
Port-security state is evidence
Dynamic MAC entries can age
Ordinary switch MAC-table learning and port-security secure-address behavior are related but not identical. Inspect both when troubleshooting.
Sticky addresses can enter running-config
That means a learned device can become part of persistent policy if the configuration is later saved.
Maximum and current counts are different
A maximum of 2 does not mean two devices are currently connected; inspect the secure MAC count and address list.
Violation count is historical evidence
A nonzero counter shows that a violation occurred, even if the currently connected endpoint is now legitimate.
A secure address does not prove authorization
Sticky learning can learn the wrong device if the port was not controlled during enrollment.
Saving preserves mistakes too
Always review sticky or static secure addresses before copying running-config to startup-config.
Phone and multi-device awareness
One physical port can legitimately represent multiple devices
Phones can complicate MAC counts
A phone with a workstation connected through it can legitimately produce more than one source MAC address on the switchport.
Voice VLAN behavior is separate
A voice VLAN may coexist with a data access VLAN on some Cisco access-port designs.
Do not assume maximum 1 everywhere
Use the endpoint role and scenario to set a reasonable secure-MAC maximum.
Inspect before applying templates
A port-security template suitable for a single desktop may break phones, access points, virtualization hosts, or other valid devices.
Evidence-based reasoning
Secure the port without misclassifying normal behavior
Gi0/5 has two MAC addresses but documentation says one workstation is connected
Weak response
Immediately shut down the port.
Better reasoning
Confirm whether there is a phone, virtual machine bridge, downstream device, or stale learning before changing the port-security policy.
A port-security violation counter is 4
Weak response
Erase the counter and move on.
Better reasoning
Treat the counter as evidence. Identify the secure MAC list, violation mode, connected device, and recent topology changes.
A port is err-disabled
Weak response
Run shutdown/no shutdown immediately.
Better reasoning
First determine why it was disabled, correct the underlying cause, preserve evidence, then recover the port.
Sticky learning captured an unfamiliar MAC
Weak response
Save the configuration because sticky means trusted.
Better reasoning
Sticky means learned, not automatically authorized. Verify the device identity before making the address persistent.
An uplink has dozens of MAC addresses
Weak response
Set maximum 1 to harden it.
Better reasoning
An uplink may legitimately carry many devices and may not be an appropriate port-security target.
A single-PC port uses violation protect
Weak response
There is no reason to inspect because protect keeps the port up.
Better reasoning
Protect can silently drop violating traffic. Inspect secure addresses and policy state if unexpected connectivity occurs.
Unsafe shortcuts
Port-security mistakes that can disconnect required systems
Enabling port security on trunks
Infrastructure links can legitimately carry many MAC addresses and may not support or suit standard access-port security behavior.
Setting maximum 1 on every port
Can break phones, virtualization hosts, access points, or other legitimate multi-MAC access designs.
Using sticky learning before verifying the connected device
Can enroll an unauthorized or accidental endpoint into persistent policy.
Clearing secure MAC state before documenting it
Removes valuable evidence about what the switch observed.
Recovering err-disabled ports before correcting the cause
The violation may immediately recur and the root cause remains unknown.
Saving immediately after sticky addresses appear
Can preserve the wrong MAC addresses across reloads.
Practice scenarios
Choose the safest next action
A port is configured maximum 1, but the design shows an IP phone and workstation.
Verify the two-device design and adjust the maximum only if both MAC addresses are legitimately required.
show port-security interface reports Secure-shutdown.
Preserve the evidence, identify the violating MAC and cause, correct the issue, then deliberately recover the interface.
Sticky learning shows a MAC address that does not match the authorized workstation.
Do not save. Verify what device was connected and remove or replace the incorrect sticky secure address according to the scenario.
A trunk uplink has many MAC addresses and no port security configured.
That can be normal. Do not apply single-host access-port security to an infrastructure trunk.
Violation restrict is configured and the legitimate PC works, but the counter keeps increasing.
Investigate whether another device or source MAC is appearing on the port rather than ignoring the counter.
A teammate wants to clear all secure addresses to make the problem disappear.
Document the current addresses and violation state first. Remove only confirmed stale or unauthorized entries.
Verification
Prove the policy protects the port without blocking the authorized device
Port role
The interface is a confirmed endpoint-facing access port.
Access VLAN
The port remains in the intended VLAN after port-security changes.
Maximum
The configured secure-MAC limit matches the legitimate endpoint design.
Secure MAC list
Every static or sticky secure address belongs to an authorized device.
Violation mode
Protect, restrict, or shutdown behavior matches the intended defensive response.
Violation count
Unexpected increases are investigated rather than ignored.
Port state
The required interface remains operational and is not unintentionally err-disabled.
End-to-end access
The authorized endpoint still reaches its gateway and required services.
Defensive lab
Build, trigger, and recover a fictional port-security policy
Build a fictional switch with one Staff workstation on Gi0/5 in VLAN 10 and verify basic connectivity before enabling port security.
Inspect the port with show interfaces switchport, show mac address-table interface, and show port-security interface where supported.
Enable port security with maximum 1 and sticky learning on the confirmed Staff access port.
Generate normal workstation traffic and verify the secure MAC address learned by the switch.
Connect a second fictional endpoint or otherwise simulate a second source MAC and observe the configured violation behavior.
Record the violation count, port state, and secure MAC list before changing anything.
Restore the authorized workstation-only state and, if necessary, recover the port after correcting the cause.
Verify the legitimate workstation can reach its gateway and required service, then review sticky state before saving.
Lesson checklist
Before moving on
I understand what Cisco port security controls.
I know that port security is primarily for confirmed endpoint-facing access ports.
I can inspect secure MAC addresses and violation state before changing policy.
I understand the difference between static, dynamic, and sticky secure MAC addresses.
I can explain protect, restrict, and shutdown violation behavior.
I know that maximum 1 is not appropriate for every access port.
I do not treat sticky learning as automatic proof of authorization.
I preserve evidence before recovering an err-disabled port.
I understand that a trunk or uplink may legitimately learn many MAC addresses.
I verify access VLAN and endpoint connectivity after port-security changes.
I investigate violation counters instead of simply clearing them.
I review learned sticky addresses before saving the configuration.
Reflection
Check your reasoning
Question 1
Why should port security usually be applied to endpoint-facing access ports instead of trunks?
Question 2
What is the practical difference between restrict and shutdown violation modes?
Question 3
Why can sticky learning accidentally make an unauthorized device persistent?
Question 4
Why might a legitimate access port need a maximum greater than one?
Question 5
What evidence should you collect before recovering an err-disabled port?
Question 6
Why does a nonzero violation counter matter even if the authorized workstation still works?
Carry this forward
Port security is strongest when the policy reflects the real endpoint role. Inspect the port, identify the legitimate MAC behavior, choose a deliberate violation response, and verify the required device still works before saving.