Courseiva
SecurityInterface Config

switchport port-security

Enables port security on a switch interface to restrict input to a limited number of MAC addresses, preventing unauthorized devices from accessing the network.

Definition: switchport port-security is a Cisco IOS interface config command. Enables port security on a switch interface to restrict input to a limited number of MAC addresses, preventing unauthorized devices from accessing the network.

Overview

The `switchport port-security` command is a fundamental security feature on Cisco switches that restricts the number of MAC addresses allowed on a specific interface. This command is critical for preventing unauthorized devices from connecting to the network, mitigating risks such as MAC flooding attacks, rogue device access, and address spoofing. By limiting the MAC addresses that can communicate through a port, network administrators can enforce access control at the edge of the network.

The concept behind port security is simple: each switch port is configured with a maximum number of allowed MAC addresses (typically one for an access port), and any traffic from an unknown MAC address triggers a security violation action (shutdown, restrict, or protect). This command is typically used on access ports connecting end-user devices, such as PCs, printers, or IP phones, where the MAC address is known and static. Alternatives include 802.1X authentication, which provides per-user authentication, or MAC address filtering via ACLs, but port security is simpler and more lightweight for static environments.

In a broader configuration workflow, port security is often enabled after basic VLAN and trunking configurations are in place, and it is verified using `show port-security` commands. Important IOS behavior: the command is available in interface configuration mode, requires privilege level 15, and its configuration is stored in the running-config. When a violation occurs, the port may be err-disabled (shutdown mode), requiring manual or automatic recovery.

The command also supports sticky MAC addresses, which dynamically learn and save MAC addresses to the running-config. Understanding port security is essential for CCNA and CCNP candidates as it appears in both exam topics and real-world network hardening.

Syntax·Interface Config
switchport port-security

When to Use This Command

  • Securing an access port in a corporate office to allow only the employee's PC and IP phone.
  • Preventing rogue devices from connecting to a switch port in a public area like a lobby.
  • Limiting the number of MAC addresses on a port to mitigate MAC flooding attacks.
  • Enforcing security policies in a data center where only specific servers are allowed on certain ports.

Parameters

ParameterSyntaxDescription
maximum<1-3072>Specifies the maximum number of secure MAC addresses allowed on the port. The default is 1. Common mistake: setting too high a value reduces security; for access ports, 1 is typical, while trunk ports may need higher values.
violationprotect | restrict | shutdownDefines the action when a security violation occurs. 'shutdown' (default) puts the port in err-disabled state; 'restrict' drops offending traffic and increments counter; 'protect' drops silently. Common mistake: forgetting that 'shutdown' requires manual or automatic recovery.
mac-addressH.H.HSpecifies a static secure MAC address for the port. If not configured, the port learns MAC addresses dynamically (up to the maximum). Common mistake: using a multicast or broadcast MAC address, which is invalid.
stickynoneEnables sticky learning, where dynamically learned MAC addresses are saved to the running-config. This parameter has no additional syntax; it is simply 'sticky'. Common mistake: not saving the config after sticky learning, causing loss on reload.
agingstatic | time <0-1440> | type {absolute | inactivity}Configures aging of secure MAC addresses. 'time' sets minutes (0 disables aging), 'type' sets absolute or inactivity aging. Common mistake: setting aging too short may cause frequent re-learning and potential violations.

Command Examples

Enable port security with default settings

Switch(config-if)# switchport port-security
Switch(config-if)#

No output indicates the command was accepted. Default settings: maximum MAC addresses = 1, violation mode = shutdown, aging disabled.

Configure port security with specific parameters

Switch(config-if)# switchport port-security maximum 2 Switch(config-if)# switchport port-security violation restrict Switch(config-if)# switchport port-security mac-address sticky
Switch(config-if)#

Sets maximum MAC addresses to 2, violation mode to restrict (drops traffic from unknown MACs but does not shut the port), and enables sticky learning to dynamically learn and save MAC addresses.

Understanding the Output

The command itself produces no output. To verify port security, use 'show port-security interface <interface>'. Key fields: Port Security (Enabled/Disabled), Port Status (Secure-up, Secure-down, Shutdown), Violation Mode (Shutdown, Restrict, Protect), Maximum MAC Addresses (configured limit), Current MAC Addresses (number learned), Security Violation Count (number of violations).

A good state shows Port Status as Secure-up and violation count at 0. A bad state shows Port Status as Shutdown or Secure-down with high violation count, indicating an attack or misconfiguration.

Configuration Scenarios

Secure an access port for a single PC

A company wants to ensure only a specific PC can connect to a switch port. The PC's MAC address is known and should be the only device allowed on that port.

Topology

PC1(MAC: 0050.7966.6800)---(Fa0/1)SW1

Steps

  1. 1.Step 1: Enter global configuration mode: SW1> enable
  2. 2.Step 2: Enter interface configuration mode: SW1# configure terminal
  3. 3.Step 3: Select the interface: SW1(config)# interface FastEthernet0/1
  4. 4.Step 4: Enable port security: SW1(config-if)# switchport port-security
  5. 5.Step 5: Set maximum MAC addresses to 1 (optional, default is 1): SW1(config-if)# switchport port-security maximum 1
  6. 6.Step 6: Specify the allowed MAC address: SW1(config-if)# switchport port-security mac-address 0050.7966.6800
  7. 7.Step 7: Set violation mode to shutdown (default): SW1(config-if)# switchport port-security violation shutdown
  8. 8.Step 8: Exit and verify: SW1(config-if)# end
Configuration
! Full IOS config block
interface FastEthernet0/1
 switchport mode access
 switchport port-security
 switchport port-security maximum 1
 switchport port-security mac-address 0050.7966.6800
 switchport port-security violation shutdown

Verify: Use 'show port-security interface FastEthernet0/1' to verify. Expected output shows 'Port Security: Enabled', 'Maximum MAC Addresses: 1', 'Sticky MAC Addresses: 0', 'Last Source Address: 0050.7966.6800', 'Security Violation Count: 0'.

Watch out: If the PC MAC address is entered incorrectly (e.g., using lowercase letters or wrong format), the port will not allow traffic and may go into err-disable state. Always verify the MAC address format (xxxx.xxxx.xxxx).

Configure sticky MAC learning on an access port for a printer

A network administrator wants to automatically learn and save the MAC address of a printer connected to a switch port, so that even after a reload, the MAC is remembered without manual entry.

Topology

Printer---(Fa0/2)SW1

Steps

  1. 1.Step 1: Enter global configuration mode: SW1> enable
  2. 2.Step 2: Enter interface configuration mode: SW1# configure terminal
  3. 3.Step 3: Select the interface: SW1(config)# interface FastEthernet0/2
  4. 4.Step 4: Enable port security: SW1(config-if)# switchport port-security
  5. 5.Step 5: Enable sticky MAC learning: SW1(config-if)# switchport port-security mac-address sticky
  6. 6.Step 6: Set maximum MAC addresses to 1: SW1(config-if)# switchport port-security maximum 1
  7. 7.Step 7: Set violation mode to restrict: SW1(config-if)# switchport port-security violation restrict
  8. 8.Step 8: Exit and save configuration: SW1(config-if)# end
  9. 9.Step 9: Save running-config to startup-config: SW1# copy running-config startup-config
Configuration
! Full IOS config block
interface FastEthernet0/2
 switchport mode access
 switchport port-security
 switchport port-security maximum 1
 switchport port-security mac-address sticky
 switchport port-security violation restrict

Verify: After the printer connects, use 'show port-security interface FastEthernet0/2' to see the sticky MAC address. Also use 'show running-config interface FastEthernet0/2' to confirm the MAC is saved as a sticky entry (e.g., 'switchport port-security mac-address sticky 0050.7966.6801').

Watch out: If the configuration is not saved to startup-config, the sticky MAC addresses will be lost after a reload. Always remember to 'copy running-config startup-config' after sticky learning.

Troubleshooting with This Command

When troubleshooting port security issues, the primary command is `show port-security interface [interface]`. Healthy output shows 'Port Security: Enabled', 'Security Violation Count: 0', and the port status as 'Secure-up'. Problem indicators include a non-zero violation count, port status 'err-disabled', or 'Security Violation Count' incrementing.

Common symptoms: a user cannot connect to the network, or the switch port LED shows amber (err-disabled). The first step is to check the port status with `show interfaces [interface] status`. If the port is err-disabled, use `show port-security interface [interface]` to see the last source MAC address that caused the violation.

That MAC is likely an unauthorized device. To recover, either remove the offending device or add its MAC to the allowed list. If the port is in err-disabled state, you can manually re-enable it with `shutdown` followed by `no shutdown` on the interface, or configure errdisable recovery with `errdisable recovery cause psecure-violation`.

Another useful command is `show port-security address` to list all secure MAC addresses on the switch. If sticky MACs are not being learned, verify that the interface is in access mode (not trunk) and that port security is enabled. Also check if the maximum MAC count has been reached.

For dynamic learning, ensure the device is sending traffic. If the violation mode is 'protect', the port remains up but drops traffic silently, making troubleshooting difficult; use `show port-security interface` to see the violation count. Correlate with `show logging` to see port-security violation messages.

In summary, a systematic approach: check port status, check violation count, identify the offending MAC, decide to allow or block, and re-enable if needed.

CCNA Exam Tips

1.

CCNA exam tip: Port security is disabled by default; you must enable it with 'switchport port-security' after setting the interface as an access port.

2.

CCNA exam tip: The default violation mode is 'shutdown', which err-disables the port. You must manually re-enable it with 'shutdown' then 'no shutdown'.

3.

CCNA exam tip: Sticky MAC addresses are added to the running config and can be saved; they are not automatically added to the startup config unless you copy run start.

4.

CCNA exam tip: The 'maximum' command sets the maximum number of secure MAC addresses; the default is 1.

Common Mistakes

Mistake 1: Forgetting to set the interface as an access port with 'switchport mode access' before enabling port security, causing the command to be rejected.

Mistake 2: Setting the maximum too low, causing legitimate devices to be blocked and triggering violations.

Mistake 3: Using violation mode 'protect' without understanding that it silently drops traffic without logging, making troubleshooting difficult.

switchport port-security vs show port-security

The commands 'switchport port-security' and 'show port-security' are commonly confused because both are essential for managing port security on Cisco switches, yet they operate in entirely different contexts: one configures the feature, while the other displays its current state. Understanding their distinct roles prevents misconfiguration and aids in troubleshooting.

Aspectswitchport port-securityshow port-security
ScopeInterface-level configurationGlobal or interface-specific display
Configuration modeInterface configuration modePrivileged EXEC mode (no configuration)
PersistencePersistent in running-configTransient output; no config change
Typical useEnabling port security and setting MAC limitsVerifying port security status and violations
Effect on deviceChanges interface operationNo operational effect; read-only

Use switchport port-security when you need to restrict access on a switch port by specifying allowed MAC addresses or setting a maximum number of secure MAC addresses.

Use show port-security when you need to verify the current port security configuration, check for violations, or troubleshoot connectivity issues related to port security.

Platform Notes

In IOS-XE (e.g., Catalyst 9000 series), the `switchport port-security` command syntax is identical to classic IOS. However, the output of `show port-security` may include additional fields like 'Aging Type' and 'Aging Time'. The NX-OS equivalent on Nexus switches is `port-security` under interface configuration, but the syntax differs: use `switchport port-security` (similar) but also requires `switchport port-security maximum` and `switchport port-security mac-address`.

NX-OS also supports `port-security aging` and `port-security violation` but with slightly different options (e.g., 'shutdown' vs 'shutdown vlan'). On ASA firewalls, port security is not directly applicable; instead, MAC address filtering is done via ACLs or 802.1X. In IOS-XR (e.g., ASR 9000), port security is not supported; use MAC filtering with ACLs or 802.1X.

Between IOS versions, the command has remained stable from 12.x to 16.x, but newer versions may support additional parameters like `switchport port-security aging type inactivity`. Always verify the exact syntax with the device's documentation.

Related Commands

show port-security

Displays the port security configuration and status on switch interfaces, used to verify and troubleshoot port security settings.

show port-security interface [intf]

Displays port security configuration and status for a specific interface, including secure MAC addresses, violation counts, and action taken.

Practice for the CCNA 200-301

Test your knowledge with practice questions covering all CCNA 200-301 exam domains.

Practice CCNA 200-301 Questions