In which configuration mode is switchport port-security maximum [n] used?

The switchport port-security maximum [n] command is entered in Interface Config mode on Cisco IOS devices.

SecurityInterface Config

switchport port-security maximum [n]

Q: What are common mistakes when using switchport port-security maximum [n]?

Setting a maximum without first enabling port security with 'switchport port-security' — the command is accepted but has no effect until port security is enabled. Setting the maximum too high, allowing too many devices and defeating the purpose of port security. Forgetting that the maximum includes dynamically learned MAC addresses; if you set it to 2 and have two sticky MACs, no new devices can connect.

Q: What should CCNA candidates know about switchport port-security maximum [n]?

Remember that the default maximum is 1 when port security is enabled, but you can change it with this command. The maximum value can be set from 1 to 3072, but the switch's hardware resources may limit the actual number. CCNA exam may test that you must also configure 'switchport port-security' to enable the feature; this command alone does not enable it.

Sets the maximum number of secure MAC addresses allowed on a switch port, limiting the number of devices that can connect through that port.

Definition: switchport port-security maximum [n] is a Cisco IOS interface config command. Sets the maximum number of secure MAC addresses allowed on a switch port, limiting the number of devices that can connect through that port.

Overview

The `switchport port-security maximum [n]` command is a critical security feature on Cisco switches that restricts the number of MAC addresses allowed on a single switch port. This command is part of the port security feature set, which helps prevent unauthorized devices from connecting to the network by limiting access based on MAC addresses. The concept behind port security is simple: each switch port can learn a finite number of MAC addresses, and any traffic from a MAC address beyond the configured maximum is either dropped or triggers a security violation (e.g., port shutdown or frame drop).

This is particularly useful in environments where physical security is a concern, such as public areas, conference rooms, or any location where unauthorized users might plug in devices. By setting a maximum, you ensure that only a known number of devices (e.g., a single PC or an IP phone plus a PC) can communicate through that port. The command is typically used in conjunction with `switchport port-security` (to enable port security) and `switchport port-security mac-address` (to specify allowed MAC addresses).

It fits into the broader network security workflow as a first line of defense at the access layer, often combined with DHCP snooping, dynamic ARP inspection, and 802.1X for comprehensive security. Important IOS behavior: the command is available in interface configuration mode, and the privilege level required is 15 (enable mode). The running configuration is updated immediately, and the change is saved to startup config only if you issue `copy running-config startup-config`.

The maximum value can range from 1 to 132 (or higher on some platforms), but the default is 1 when port security is enabled. If you set the maximum to a value lower than the number of currently learned MAC addresses, the port will immediately violate and take the configured action (shutdown, restrict, or protect). Also, note that the maximum includes both statically configured and dynamically learned MAC addresses.

For example, if you set `switchport port-security maximum 2` and statically configure one MAC, only one dynamic MAC can be learned. This command is often used in scenarios where you want to allow a single device (maximum 1) or a device plus an IP phone (maximum 2, with the phone's MAC learned via CDP). Alternatives include using 802.1X for per-user authentication or MAC authentication bypass (MAB), but port security is simpler and does not require a RADIUS server.

In troubleshooting, verifying the maximum setting is crucial when a port is flapping or when users report connectivity issues after connecting a new device. The command `show port-security interface` displays the current maximum and the count of secure MAC addresses, helping identify if the limit has been reached. Overall, `switchport port-security maximum` is a foundational command for access layer security in Cisco networks.

Syntax·Interface Config

switchport port-security maximum [n]

When to Use This Command

Limit an access port to a single device (e.g., a user PC) to prevent unauthorized hubs or switches from being connected.
Allow up to 10 devices on a port used for a small office or conference room with multiple devices.
Restrict a trunk port to a specific number of VLANs or devices for security in a multi-tenant environment.
Set a maximum of 2 MAC addresses on a port connecting to a VoIP phone and a PC (phone daisy-chained).

Parameters

Parameter	Syntax	Required	Description
n	<1-132>	Required	Specifies the maximum number of secure MAC addresses allowed on the port. Valid values range from 1 to 132 (or higher on some platforms, but typically 132 is the maximum for most Catalyst switches). Common values are 1 for a single device, 2 for a device plus an IP phone, or a higher number for a hub. A common mistake is setting the value too high, which defeats the security purpose, or too low, causing legitimate devices to be blocked. Also, note that the maximum includes both static and dynamic MAC addresses.

Command Examples

Limit port to one device

Switch(config-if)# switchport port-security maximum 1

No output is generated; the command configures the port to allow only one secure MAC address. If more than one device attempts to send traffic, a security violation occurs.

Set maximum to 5 MAC addresses

Switch(config-if)# switchport port-security maximum 5

No output; the port now allows up to 5 secure MAC addresses. Any additional MAC addresses will trigger a violation.

Understanding the Output

The command itself produces no output. To verify the configuration, use 'show port-security interface [interface]'. The output shows 'Maximum MAC Addresses' field indicating the configured limit.

A value of 1 means only one device is allowed; higher values allow multiple devices. If the 'Current MAC Addresses' count exceeds the maximum, a violation is logged. In a real network, you would check this to ensure the port is not allowing more devices than intended, which could indicate a security breach or misconfiguration.

Configuration Scenarios

Restrict a switch port to a single device

In a corporate office, each desk should only have one PC connected. To prevent users from plugging in a hub or switch, set the maximum MAC addresses to 1. If a second device is detected, the port will shut down (default violation mode).

Topology

PC1---(Fa0/1)SW1

Steps

1.Step 1: Enter global configuration mode: SW1> enable
2.Step 2: Enter interface configuration mode: SW1# configure terminal
3.Step 3: Select the interface: SW1(config)# interface FastEthernet0/1
4.Step 4: Enable port security: SW1(config-if)# switchport port-security
5.Step 5: Set the maximum number of MAC addresses to 1: SW1(config-if)# switchport port-security maximum 1
6.Step 6: (Optional) Set the violation mode to shutdown (default): SW1(config-if)# switchport port-security violation shutdown
7.Step 7: Exit and verify: SW1(config-if)# end

Configuration

! Configuration for FastEthernet0/1
interface FastEthernet0/1
 switchport mode access
 switchport port-security
 switchport port-security maximum 1
 switchport port-security violation shutdown
!

Verify: Use `show port-security interface FastEthernet0/1` to verify. Expected output shows 'Maximum MAC Addresses: 1', 'Current MAC Addresses: 1', and 'Security Violation Count: 0' if only one device is connected.

Watch out: If the port is in trunk mode, port security is not supported. Ensure the port is configured as an access port using `switchport mode access` before enabling port security.

Allow a PC and an IP phone on the same port

In a VoIP environment, a single switch port connects an IP phone and a PC daisy-chained through the phone. The phone uses one MAC address, and the PC uses another. Set the maximum to 2 to allow both devices.

Topology

PC---(Phone)---(Fa0/1)SW1

Steps

1.Step 1: Enter global configuration mode: SW1> enable
2.Step 2: Enter interface configuration mode: SW1# configure terminal
3.Step 3: Select the interface: SW1(config)# interface FastEthernet0/1
4.Step 4: Configure the port as an access port: SW1(config-if)# switchport mode access
5.Step 5: Enable port security: SW1(config-if)# switchport port-security
6.Step 6: Set the maximum to 2: SW1(config-if)# switchport port-security maximum 2
7.Step 7: (Optional) Statically configure the phone's MAC address for extra security: SW1(config-if)# switchport port-security mac-address aaaa.bbbb.cccc
8.Step 8: Set the violation mode to restrict (drops frames but does not shut down): SW1(config-if)# switchport port-security violation restrict
9.Step 9: Exit and verify: SW1(config-if)# end

Configuration

! Configuration for FastEthernet0/1
interface FastEthernet0/1
 switchport mode access
 switchport port-security
 switchport port-security maximum 2
 switchport port-security mac-address aaaa.bbbb.cccc
 switchport port-security violation restrict
!

Verify: Use `show port-security interface FastEthernet0/1` to verify. Expected output shows 'Maximum MAC Addresses: 2', 'Current MAC Addresses: 2' (one static, one dynamic), and 'Security Violation Count: 0'. Also use `show mac address-table interface FastEthernet0/1` to see the learned MACs.

Watch out: The IP phone's MAC address is often learned via CDP before the PC's MAC. If the phone is not powered on first, the PC's MAC might be learned first, and when the phone boots, it could cause a violation if the maximum is already reached. To avoid this, statically configure the phone's MAC or use the `switchport port-security mac-address sticky` command to dynamically learn and save MACs.

Troubleshooting with This Command

When troubleshooting port security issues, the `switchport port-security maximum` command is often at the center of connectivity problems. A common symptom is a port that goes into errdisable state or drops traffic intermittently. The first step is to check the port's status with `show interfaces status` or `show interfaces [interface]`.

If the port is in errdisable state, it likely experienced a security violation. Use `show port-security interface [interface]` to see the current maximum, the number of secure MAC addresses, and the violation count. Healthy output shows 'Maximum MAC Addresses: [n]', 'Current MAC Addresses: [m]' (where m <= n), and 'Security Violation Count: 0'.

If the violation count is non-zero, the port has seen more MAC addresses than allowed. The output also shows the last source MAC address that caused a violation, which is critical for identifying the offending device. For example, if you set maximum to 1 but see a violation from MAC 0011.2233.4455, that MAC is the second device.

You can then use `show mac address-table` to find which device that MAC belongs to. Another useful command is `show port-security address` which lists all secure MAC addresses on the switch, including the interface and type (static, dynamic, sticky). If the port is not in errdisable but users report connectivity issues, check the violation mode.

If set to 'restrict', frames from excess MACs are dropped but the port stays up; this can cause partial connectivity. Use `show port-security interface` to see the 'Security Violation Count' increasing. If it's increasing, you need to either increase the maximum or identify and remove unauthorized devices.

A step-by-step diagnostic flow: 1) Identify the affected interface. 2) Check port status and errdisable reason. 3) If errdisable, re-enable the port with `shutdown` followed by `no shutdown` after fixing the cause. 4) Use `show port-security interface` to see current MAC count and maximum. 5) Compare with expected devices. 6) If count is less than maximum but violations occur, check for MAC flapping (same MAC on multiple ports) using `show mac address-table move` or `debug port-security`. 7) If count equals maximum, decide whether to increase the maximum or remove a static MAC. 8) To clear learned MACs, use `clear port-security sticky [interface]` or `clear mac address-table secure [interface]`. Correlating with other commands: `show mac address-table interface [interface]` shows all MACs learned on the port (including non-secure if port security is not enabled). `show logging` may show port security violation messages. `debug port-security` can be used in a lab to see real-time violations. Remember that the maximum includes both static and dynamic MACs; if you statically configure a MAC, it counts toward the limit.

Also, if you change the maximum to a lower value than the current count, the port will immediately violate. Always plan the maximum based on the number of devices that legitimately connect through the port.

CCNA Exam Tips

Remember that the default maximum is 1 when port security is enabled, but you can change it with this command.

The maximum value can be set from 1 to 3072, but the switch's hardware resources may limit the actual number.

CCNA exam may test that you must also configure 'switchport port-security' to enable the feature; this command alone does not enable it.

Be aware that setting a maximum does not automatically set the violation mode; you must configure that separately.

Common Mistakes

Setting a maximum without first enabling port security with 'switchport port-security' — the command is accepted but has no effect until port security is enabled.

Setting the maximum too high, allowing too many devices and defeating the purpose of port security.

Forgetting that the maximum includes dynamically learned MAC addresses; if you set it to 2 and have two sticky MACs, no new devices can connect.

switchport port-security maximum [n] vs show port-security interface [intf]

These two commands are often confused because both relate to port security, but one configures a limit while the other displays status. Understanding the difference is crucial for effective troubleshooting and configuration.

Aspect	switchport port-security maximum [n]	show port-security interface [intf]
Scope	Configures a single interface	Displays status for a single interface
Configuration mode	Interface Configuration mode	Privileged EXEC mode
Persistence	Saved to running config	Not saved; run-time output only
Precedence	Sets upper limit on secure MAC addresses	Shows current count and violations
Typical use	Limiting devices per port	Verifying port security status

Use switchport port-security maximum [n] when you need to restrict the number of devices that can connect to a switch port.

Use show port-security interface [intf] when you need to verify the current port security settings, secure MAC addresses, or violation counts on a specific interface.

Platform Notes

On IOS-XE (e.g., Catalyst 9000 series), the `switchport port-security maximum` command syntax is identical to classic IOS. However, the maximum value may be higher (up to 4096 on some platforms) and the default violation mode is 'shutdown'. On NX-OS (e.g., Nexus switches), port security is configured differently.

The equivalent command is `port-security maximum <value>` under interface configuration, but NX-OS uses a different feature set called 'port security' that is similar but not identical. For example, on Nexus 9000, you enable port security with `switchport port-security` and set maximum with `switchport port-security maximum <value>`. However, NX-OS also supports 'port-security mac-address' and 'port-security violation' commands.

On ASA firewalls, there is no direct equivalent; port security is a switch feature. For IOS-XR (e.g., ASR 9000), port security is not supported in the same way; instead, you would use MAC address filtering or 802.1X. In terms of IOS versions, the command has been available since IOS 12.1(1)E and remains consistent through 15.x and 16.x.

One difference: in older IOS (12.x), the default maximum was 1 when port security was enabled, but in newer versions, you must explicitly set the maximum; otherwise, the default is 1. Also, on some older Catalyst switches (e.g., 2950), the maximum was limited to 132, while newer switches support up to 4096. Always check the platform documentation for the exact maximum supported.

The output of `show port-security interface` may vary slightly; for example, on IOS-XE, it includes a 'SecurityViolation' counter, while on classic IOS, it shows 'SecurityViolation Count'. Overall, the command is consistent across Cisco switching platforms, but always verify with the specific IOS version.

Related Commands

show port-security interface [intf]

Displays port security configuration and status for a specific interface, including secure MAC addresses, violation counts, and action taken.

Practice for the CCNA 200-301

Test your knowledge with practice questions covering all CCNA 200-301 exam domains.

Practice CCNA 200-301 Questions