Courseiva
SecurityInterface Config

switchport port-security violation [protect|restrict|shutdown]

Configures the action a switch port takes when a security violation occurs, such as when the maximum MAC addresses is exceeded or an unauthorized MAC address attempts to communicate.

Definition: switchport port-security violation [protect|restrict|shutdown] is a Cisco IOS interface config command. Configures the action a switch port takes when a security violation occurs, such as when the maximum MAC addresses is exceeded or an unauthorized MAC address attempts to communicate.

Overview

The `switchport port-security violation` command is a critical tool for securing access layer ports on Cisco switches. It defines the action a switch port takes when a security violation occurs—typically when the maximum number of allowed MAC addresses is exceeded or an unauthorized MAC address attempts to communicate. This command is part of the broader port security feature, which helps prevent unauthorized devices from connecting to the network, thereby mitigating risks such as MAC flooding attacks, rogue devices, and unauthorized access.

Port security is commonly deployed on edge ports that connect to end-user devices, printers, IP phones, or other trusted endpoints. The violation action determines how the switch responds to a breach: `protect` silently drops traffic from unknown MACs without generating alerts, `restrict` drops traffic and sends a syslog message or SNMP trap, and `shutdown` (the default) error-disables the port, effectively blocking all traffic until manually or automatically recovered. Understanding these options is essential for balancing security with operational continuity.

For example, in a dynamic environment where devices are frequently swapped, `restrict` may be preferable to avoid manual port re-enablement, while in a high-security zone, `shutdown` provides a clear indicator of a violation. The command operates in interface configuration mode and requires the port to be in access mode (or trunk mode with specific configurations) and port security enabled globally via `switchport port-security`. It is important to note that the violation action is applied per interface and can be changed dynamically; however, changing the action does not clear an existing error-disabled state—the port must be manually shut/no shut or recovered via `errdisable recovery`.

This command is typically used in conjunction with `switchport port-security maximum` and `switchport port-security mac-address` to define the allowed MAC addresses. In a typical workflow, a network engineer first enables port security, sets the maximum MAC count, optionally statically configures allowed MACs, and then selects the violation action. Verification is done via `show port-security interface` and `show port-security address`.

The command is available in IOS, IOS-XE, and NX-OS (with slight syntax differences), but not in IOS-XR. Proper use of this command enhances network security without sacrificing manageability, making it a staple in CCNA and CCNP curricula.

Syntax·Interface Config
switchport port-security violation [protect|restrict|shutdown]

When to Use This Command

  • Preventing unauthorized devices from accessing the network by shutting down the port when a violation occurs.
  • Allowing limited access by restricting traffic from unknown MAC addresses while logging violations.
  • Protecting against MAC flooding attacks by protecting the port without shutting it down.
  • Enforcing security policies in a campus network where only specific devices are allowed on certain ports.

Parameters

ParameterSyntaxDescription
protectprotectDrops packets from unknown MAC addresses without sending a syslog message or SNMP trap. The port remains operational, and the security violation counter is not incremented. This is the least disruptive option but provides no notification of a violation.
restrictrestrictDrops packets from unknown MAC addresses and sends a syslog message and SNMP trap. The violation counter is incremented. The port remains up, but traffic from unauthorized sources is discarded. This provides notification without disabling the port.
shutdownshutdownImmediately error-disables the port when a violation occurs. The port LED turns amber, and all traffic is blocked. A syslog message is generated. This is the default action and provides the strongest security response, but requires manual or automatic recovery to restore service.

Command Examples

Configure port security violation to shutdown

Switch(config-if)# switchport port-security violation shutdown

This command sets the violation mode to shutdown, which will err-disable the port if a violation occurs. No output is shown upon successful configuration.

Configure port security violation to restrict

Switch(config-if)# switchport port-security violation restrict

This command sets the violation mode to restrict, which will drop packets from unknown MAC addresses and increment the violation counter. No output is shown upon successful configuration.

Understanding the Output

This command does not produce output on its own. To verify the violation mode, use 'show port-security interface <interface>'. The output will display the 'Violation Mode' field, which can be 'shutdown', 'restrict', or 'protect'.

In 'shutdown' mode, the port will be err-disabled and show 'Port Status: secure-down' or 'err-disabled'. In 'restrict' mode, the port remains up but drops violating traffic and increments the violation counter. In 'protect' mode, the port drops violating traffic silently without incrementing the counter.

Watch for 'Violation Count' to increase in restrict mode, indicating unauthorized access attempts.

Configuration Scenarios

Configure port security with shutdown violation on an access port for a printer

A network administrator wants to secure a switch port connected to a printer. Only the printer's MAC address should be allowed. If any other device connects, the port should be shut down to prevent unauthorized access.

Topology

SW1(Gi0/1)---Printer (MAC: aaaa.bbbb.cccc)

Steps

  1. 1.Step 1: Enter global configuration mode: SW1> enable
  2. 2.Step 2: Enter interface configuration mode for Gi0/1: SW1# configure terminal
  3. 3.Step 3: Set the interface to access mode: SW1(config)# interface GigabitEthernet0/1
  4. 4.Step 4: Enable port security: SW1(config-if)# switchport mode access
  5. 5.Step 5: Set the maximum number of MAC addresses to 1: SW1(config-if)# switchport port-security
  6. 6.Step 6: Statically configure the printer's MAC address: SW1(config-if)# switchport port-security maximum 1
  7. 7.Step 7: Set the violation action to shutdown (default, but explicit): SW1(config-if)# switchport port-security mac-address aaaa.bbbb.cccc
  8. 8.Step 8: Exit configuration mode: SW1(config-if)# switchport port-security violation shutdown
  9. 9.Step 9: Verify the configuration: SW1(config-if)# end
Configuration
!
interface GigabitEthernet0/1
 switchport mode access
 switchport port-security
 switchport port-security maximum 1
 switchport port-security mac-address aaaa.bbbb.cccc
 switchport port-security violation shutdown
!

Verify: Use `show port-security interface GigabitEthernet0/1` to verify. Expected output includes: Port Security: Enabled, Violation Mode: Shutdown, Maximum MAC Addresses: 1, Current MAC Addresses: 1, Security Violation Count: 0.

Watch out: If the printer is replaced, the new MAC address will cause a violation and shut down the port. The administrator must either remove the old MAC and add the new one, or use sticky learning to dynamically learn the first MAC.

Configure port security with restrict violation on a voice VLAN port for IP phones

A company deploys IP phones on a switch port configured with a voice VLAN. The port should allow the phone's MAC and one PC behind the phone. If an unknown device connects, traffic should be dropped but the port should remain up to avoid disrupting voice calls.

Topology

SW1(Gi0/2)---IP Phone (MAC: 1111.2222.3333)---PC (MAC: 4444.5555.6666)

Steps

  1. 1.Step 1: Enter global configuration mode: SW1> enable
  2. 2.Step 2: Enter interface configuration mode for Gi0/2: SW1# configure terminal
  3. 3.Step 3: Set the interface to trunk mode for voice VLAN: SW1(config)# interface GigabitEthernet0/2
  4. 4.Step 4: Enable port security: SW1(config-if)# switchport mode trunk
  5. 5.Step 5: Set maximum MAC addresses to 2 (phone + PC): SW1(config-if)# switchport port-security
  6. 6.Step 6: Statically configure the phone's MAC: SW1(config-if)# switchport port-security maximum 2
  7. 7.Step 7: Set violation action to restrict: SW1(config-if)# switchport port-security mac-address 1111.2222.3333
  8. 8.Step 8: Exit configuration mode: SW1(config-if)# switchport port-security violation restrict
  9. 9.Step 9: Verify: SW1(config-if)# end
Configuration
!
interface GigabitEthernet0/2
 switchport mode trunk
 switchport port-security
 switchport port-security maximum 2
 switchport port-security mac-address 1111.2222.3333
 switchport port-security violation restrict
!

Verify: Use `show port-security interface GigabitEthernet0/2`. Expected output: Violation Mode: Restrict, Security Violation Count: 0. If a violation occurs, the count increments and syslog messages appear, but the port stays up.

Watch out: On trunk ports, port security must be configured with care; the allowed MAC addresses count includes those on all VLANs. Also, the voice VLAN MAC (phone) is typically learned via CDP, so static configuration may not be necessary if sticky learning is used.

Troubleshooting with This Command

When troubleshooting port security violations, the primary command is `show port-security interface [interface-id]`. Healthy output shows 'Port Security: Enabled', 'Violation Mode: [protect/restrict/shutdown]', 'Security Violation Count: 0', and 'Current MAC Addresses' less than or equal to the maximum. A problem indicator is a non-zero violation count, especially if it increments rapidly, suggesting an unauthorized device is attempting to connect.

If the violation mode is 'shutdown', the port will be in 'err-disabled' state, visible via `show interfaces status` or `show interfaces [interface-id]` (status: err-disabled). The `show port-security address` command lists all secure MAC addresses on the switch, helping identify which MACs are allowed and which are causing violations. Common symptoms include users losing connectivity, ports showing amber LEDs, and syslog messages like '%PORT_SECURITY-2-PSECURE_VIOLATION: Security violation occurred on interface Gi0/1'.

To diagnose, first check the port status: `show interfaces Gi0/1` to see if it's err-disabled. If so, check the violation count: `show port-security interface Gi0/1`. If the count is high, examine the secure MAC list to see if an unexpected MAC is present.

Use `show mac address-table interface Gi0/1` to see all learned MACs. If the violation is due to exceeding the maximum, either increase the maximum or remove unused MACs. If due to an unauthorized MAC, identify the device (via MAC OUI lookup) and decide whether to allow it.

For sticky MAC addresses, ensure sticky learning is enabled: `switchport port-security mac-address sticky`. To recover an err-disabled port, use `shutdown` followed by `no shutdown` on the interface, or configure errdisable recovery: `errdisable recovery cause psecure-violation` and `errdisable recovery interval 300`. Correlate with `show logging` to see violation timestamps.

In complex scenarios, use `debug port-security` (caution: high CPU) to see real-time violation events. Remember that changing the violation action does not clear an existing err-disabled state; you must manually recover the port. Also, port security is not supported on all switch platforms or in all modes (e.g., dynamic, desirable trunking).

Always verify compatibility with the switch model and IOS version.

CCNA Exam Tips

1.

Remember that 'shutdown' is the default violation mode for port security.

2.

In the CCNA exam, know that 'restrict' drops violating frames and increments the violation counter, while 'protect' drops frames silently without incrementing the counter.

3.

Be aware that a port in err-disable state due to a security violation must be manually re-enabled with 'shutdown' followed by 'no shutdown' or by configuring 'errdisable recovery cause psecure-violation'.

4.

The 'protect' mode is not recommended for security because it does not log violations, making it harder to detect attacks.

Common Mistakes

Confusing 'restrict' and 'protect': 'restrict' increments the violation counter, 'protect' does not.

Forgetting that 'shutdown' mode err-disables the port and requires manual intervention to recover.

Not enabling port security first with 'switchport port-security' before setting the violation mode.

switchport port-security violation [protect|restrict|shutdown] vs show port-security interface [intf]

Both commands relate to port security violations but serve different purposes: the first configures the action upon a violation, while the second displays current status and statistics. They are often considered together because one sets the policy and the other verifies it.

Aspectswitchport port-security violation [protect|restrict|shutdown]show port-security interface [intf]
ScopeDefines violation actionDisplays configuration and stats
Configuration modeInterface configurationPrivileged EXEC
PersistencePersistent in running-configOutput is transient
Typical useInitial setup or policy changeTroubleshooting or verification
Effect on switchAlters behavior on violationRead-only, no change

Use switchport port-security violation [protect|restrict|shutdown] when you need to define the switch's response to a port security violation, such as setting the port to shutdown mode.

Use show port-security interface [intf] when you need to verify the current violation action, count violations, or see which secure MAC addresses are learned on the port.

Platform Notes

In IOS-XE (e.g., Catalyst 3650/3850/9300), the syntax is identical to classic IOS. However, the output of `show port-security` may include additional fields like 'Last Source Address' and 'Last Violation Time'. On NX-OS (e.g., Nexus 9000), the equivalent command is `switchport port-security violation {protect | restrict | shutdown}` under interface configuration, but port security is configured differently: first enable `feature port-security` globally, then use `switchport port-security` on the interface.

The NX-OS syntax for setting violation action is the same as IOS. Note that NX-OS does not support port security on trunk ports in some versions. On ASA devices, port security is not directly applicable; instead, use features like MAC address filtering or 802.1X.

IOS-XR does not support port security; it uses different mechanisms like MACsec or ACLs. In older IOS versions (12.x), port security was limited to access ports; from 15.x onward, it can be used on trunk ports with caution. In IOS 15.0 and later, the `switchport port-security mac-address sticky` command is available to dynamically learn and save MAC addresses.

The violation action 'protect' may not increment the violation counter in some versions, so monitoring is less effective. Always check the specific platform documentation for nuances.

Related Commands

show port-security

Displays the port security configuration and status on switch interfaces, used to verify and troubleshoot port security settings.

show port-security interface [intf]

Displays port security configuration and status for a specific interface, including secure MAC addresses, violation counts, and action taken.

Practice for the CCNA 200-301

Test your knowledge with practice questions covering all CCNA 200-301 exam domains.

Practice CCNA 200-301 Questions