switchport port-security mac-address [mac|sticky]

Overview

The `switchport port-security mac-address` command is a fundamental tool in Cisco IOS for enforcing port security on switch access ports. It allows a network administrator to statically define which MAC addresses are permitted to communicate through a specific switchport, or to enable sticky learning where the switch dynamically learns and remembers MAC addresses. This command is critical for mitigating Layer 2 attacks such as MAC flooding, where an attacker floods the switch with frames containing spoofed MAC addresses to overflow the MAC address table and force the switch into fail-open mode (hub behavior).

By limiting the number of allowed MAC addresses per port, port security prevents unauthorized devices from connecting to the network, enhancing overall security posture. The command is typically used on access ports connected to end devices like PCs, printers, or IP phones, where the number of expected MAC addresses is known and limited. It is an alternative to more complex solutions like 802.1X authentication, which requires a RADIUS server, or MAC authentication bypass (MAB), which is often used in conjunction with 802.1X.

Port security is simpler to configure but less flexible; it is best suited for environments where devices are static and predictable. In the broader configuration workflow, port security is often one of several security features applied to switchports, alongside features like BPDU guard, root guard, and DHCP snooping. The command operates in interface configuration mode and requires the port to be configured as an access port (using `switchport mode access`) before enabling port security.

When a violation occurs (e.g., a new MAC address appears after the maximum limit is reached), the switch can be configured to protect (drop traffic), restrict (drop and log), or shutdown (error-disable the port). The `mac-address` parameter allows manual entry of a specific MAC address, while the `sticky` keyword enables the switch to dynamically learn MAC addresses and add them to the running configuration as secure MAC addresses. This is particularly useful for environments where devices are frequently swapped, as the switch remembers the MAC addresses without manual reconfiguration.

However, sticky MAC addresses are stored in the running configuration and are lost on reload unless saved to startup configuration. A common mistake is forgetting to set the maximum number of secure MAC addresses using `switchport port-security maximum <value>`; the default is 1, which may be too restrictive for ports with IP phones (which require two MAC addresses: phone and PC). Another pitfall is enabling port security on trunk ports, which is generally not recommended because trunks carry multiple VLANs and many MAC addresses.

The command is available in IOS 12.x and later, including IOS-XE, but not in NX-OS (which uses `port-security` under interface configuration with different syntax). In terms of privilege level, the command requires privileged EXEC mode (enable) and is applied in global configuration mode. The impact on running configuration is immediate; the configured MAC addresses appear under the interface as `switchport port-security mac-address <mac>` or `switchport port-security mac-address sticky`.