show port-security
Displays the port security configuration and status on switch interfaces, used to verify and troubleshoot port security settings.
Definition: show port-security is a Cisco IOS privileged exec command. Displays the port security configuration and status on switch interfaces, used to verify and troubleshoot port security settings.
Overview
The 'show port-security' command is a vital diagnostic tool in Cisco IOS that displays the current port security configuration and operational status on switch interfaces. Port security is a Layer 2 security feature that restricts input to an interface by limiting the MAC addresses allowed to send traffic, thereby preventing unauthorized devices from connecting to the network. This command is essential for network engineers to verify that port security policies are correctly applied, monitor the number of secure MAC addresses learned, and identify security violations.
It is typically used after configuring port security on an interface to confirm the settings, or during troubleshooting when a port is err-disabled due to a security violation. Unlike 'show running-config', which shows the configuration but not the dynamic state, 'show port-security' provides real-time information such as the current count of secure MAC addresses, the violation mode, and the last violation time. This command fits into the broader network troubleshooting workflow when investigating connectivity issues, unauthorized access attempts, or port flapping.
In terms of IOS behavior, the command output is buffered and can be filtered with 'include', 'section', or 'begin' modifiers. It requires privileged EXEC mode (enable) and does not affect the running configuration. Understanding this command is crucial for CCNA and CCNP candidates as port security is a common topic in the exams and a fundamental security practice in campus networks.
show port-securityWhen to Use This Command
- Check if port security is enabled on a specific interface and view the current secure MAC addresses.
- Verify the maximum number of secure MAC addresses allowed and the violation mode configured.
- Identify interfaces where security violations have occurred and the action taken.
- Monitor sticky MAC address learning and aging status.
Parameters
| Parameter | Syntax | Description |
|---|---|---|
| interface | interface-type interface-number | Specifies a particular interface (e.g., GigabitEthernet0/1) to display port security information for that interface only. If omitted, the command shows port security status for all interfaces. Common mistake is using an invalid interface or forgetting the interface type. |
| address | address | Displays only the secure MAC addresses learned on all interfaces or a specified interface. This parameter is used to quickly view the MAC address table entries secured by port security. It is often used with the 'interface' parameter to filter per interface. |
Command Examples
Basic show port-security output
show port-securitySecure Port MaxSecureAddr CurrentAddr SecurityViolation Security Action
(Count) (Count) (Count)
--------------------------------------------------------------------
Gi0/1 1 1 0 Shutdown
Gi0/2 5 3 2 Restrict
Gi0/3 2 2 1 Protect
--------------------------------------------------------------------
Total Addresses in System (excluding one mac per port) : 6
Max Addresses limit in System (excluding one mac per port) : 1024The output lists each secure port with its configured maximum secure addresses, current count of learned addresses, number of security violations, and the violation action (Shutdown, Restrict, or Protect). The summary shows total addresses in the system and the system-wide limit.
Show port-security for a specific interface
show port-security interface gigabitEthernet 0/1Port Security : Enabled Port Status : Secure-up Violation Mode : Shutdown Aging Time : 0 mins Aging Type : Absolute SecureStatic Address Aging : Disabled Maximum MAC Addresses : 1 Total MAC Addresses : 1 Configured MAC Addresses : 0 Sticky MAC Addresses : 1 Last Source Address:Vlan : 0050.7966.6800:10 Security Violation Count : 0
Shows detailed port security settings for a single interface: whether it's enabled, port status (Secure-up means no violation), violation mode, aging parameters, maximum and current MAC counts, configured vs sticky addresses, last source MAC and VLAN, and violation count.
Understanding the Output
The 'show port-security' command output is a table listing all interfaces with port security enabled. Key columns: Secure Port (interface name), MaxSecureAddr (maximum allowed MAC addresses), CurrentAddr (number of learned MACs), SecurityViolation (count of violations since last reset), Security Action (Shutdown, Restrict, or Protect). A high violation count indicates a security issue (e.g., unauthorized device).
The summary line shows total addresses in the system and the system-wide maximum. For interface-specific output, additional fields like Aging Time, Aging Type, Sticky MAC Addresses, and Last Source Address help in detailed troubleshooting. A port status of 'Secure-down' or 'Secure-shutdown' indicates a violation has occurred.
Watch for 'Security Violation Count' > 0, which means an unauthorized MAC tried to access the port.
Configuration Scenarios
Configure Port Security on an Access Port for a Single Device
A company wants to ensure that only a specific employee's PC can connect to a particular switch port. The PC's MAC address is known, and the port should shut down if any other device is connected.
Topology
PC1(00:11:22:33:44:55)---(Gi0/1)SW1Steps
- 1.Step 1: Enter global configuration mode: configure terminal
- 2.Step 2: Enter interface configuration mode: interface GigabitEthernet0/1
- 3.Step 3: Set the interface as an access port: switchport mode access
- 4.Step 4: Enable port security: switchport port-security
- 5.Step 5: Set the maximum number of secure MAC addresses to 1: switchport port-security maximum 1
- 6.Step 6: Specify the allowed MAC address: switchport port-security mac-address 0011.2233.4455
- 7.Step 7: Set violation mode to shutdown (default): switchport port-security violation shutdown
- 8.Step 8: Exit interface mode: exit
- 9.Step 9: Verify configuration: show port-security interface GigabitEthernet0/1
! interface GigabitEthernet0/1 switchport mode access switchport port-security switchport port-security maximum 1 switchport port-security mac-address 0011.2233.4455 switchport port-security violation shutdown !
Verify: Use 'show port-security interface GigabitEthernet0/1'. Expected output shows Port Security: Enabled, Violation Mode: Shutdown, Maximum MAC Addresses: 1, Current MAC Addresses: 1, Security Violation Count: 0.
Watch out: If the interface is not configured as an access port (or a trunk with port security), port security commands may be rejected. Also, the MAC address must be entered in dotted-triple format (xxxx.xxxx.xxxx).
Configure Sticky MAC Addresses on a Trunk Port for Dynamic Learning
A branch office has a switch with multiple VLANs on a trunk link to a server. The network administrator wants to dynamically learn MAC addresses from the server and convert them to secure MAC addresses automatically, with a limit of 10 MACs.
Topology
Server---(Gi0/2)SW1 (trunk to distribution)Steps
- 1.Step 1: Enter global configuration mode: configure terminal
- 2.Step 2: Enter interface configuration mode: interface GigabitEthernet0/2
- 3.Step 3: Set the interface as a trunk: switchport mode trunk
- 4.Step 4: Enable port security: switchport port-security
- 5.Step 5: Set maximum MAC addresses to 10: switchport port-security maximum 10
- 6.Step 6: Enable sticky MAC learning: switchport port-security mac-address sticky
- 7.Step 7: Set violation mode to restrict: switchport port-security violation restrict
- 8.Step 8: Exit interface mode: exit
- 9.Step 9: Verify: show port-security interface GigabitEthernet0/2
! interface GigabitEthernet0/2 switchport mode trunk switchport port-security switchport port-security maximum 10 switchport port-security mac-address sticky switchport port-security violation restrict !
Verify: Use 'show port-security interface GigabitEthernet0/2'. Expected output shows Port Security: Enabled, Violation Mode: Restrict, Maximum MAC Addresses: 10, Current MAC Addresses: <dynamic count>, Sticky MAC Addresses: <list>. Also use 'show port-security address' to see the sticky MACs.
Watch out: On trunk ports, port security is supported but with caveats: the maximum MAC addresses applies per VLAN, and sticky MAC addresses are learned per VLAN. Also, the 'violation restrict' mode drops offending traffic but does not err-disable the port; this may be undesirable if strict security is needed.
Troubleshooting with This Command
When troubleshooting port security issues, the 'show port-security' command is the first line of defense. A healthy output for an interface with port security enabled shows 'Port Security: Enabled', 'Violation Mode: Shutdown' (or restrict/protect), 'Maximum MAC Addresses: 1' (or configured number), 'Current MAC Addresses: 1' (or less than max), and 'Security Violation Count: 0'. If the violation count is non-zero, it indicates that unauthorized MAC addresses attempted to send traffic.
The 'Last Source Address:Vlan' field shows the offending MAC and VLAN. A common symptom is an interface going into err-disabled state; this is indicated by 'Port Status: Err-disabled' in the output of 'show interfaces'. To recover, the administrator must manually shut/no shut the interface or configure errdisable recovery.
Another symptom is intermittent connectivity; if the violation mode is 'restrict', the port stays up but drops traffic from unauthorized MACs. The 'show port-security address' command lists all secure MAC addresses, including sticky and static. If the count of secure MACs is less than expected, check if the device is actually sending traffic or if the MAC address was manually configured incorrectly.
A step-by-step diagnostic flow: 1) Check if the interface is err-disabled with 'show interfaces status'. 2) If err-disabled, use 'show port-security interface <int>' to see violation count and last source. 3) Verify the allowed MAC list with 'show port-security address'. 4) Check the running configuration for the interface to ensure port security is enabled and parameters are correct. 5) If using sticky MAC, ensure the device has sent traffic to learn the MAC. Correlate with 'show mac address-table' to see dynamically learned MACs. Also, use 'debug port-security' to see real-time events, but use with caution in production.
The 'show port-security' command can be combined with 'show interfaces' to check for input errors or CRC errors that might indicate a security issue or hardware problem.
CCNA Exam Tips
CCNA exam may ask which violation mode (Shutdown, Restrict, Protect) disables the port vs. drops traffic but keeps the port up.
Remember that 'Sticky MAC' addresses are dynamically learned and added to the running config; they survive a reload only if saved.
The 'show port-security' command shows only interfaces with port security enabled; if no output, port security is not configured.
Know that 'Security Violation Count' increments for each violation; the port may be in errdisable state if action is Shutdown.
Common Mistakes
Mistake 1: Forgetting that 'Shutdown' mode puts the port in errdisable state; you must manually re-enable it or configure errdisable recovery.
Mistake 2: Assuming 'show port-security' shows all interfaces; it only shows those with port security enabled.
Mistake 3: Confusing 'Sticky MAC' with 'Secure MAC'; sticky MACs are saved in config, secure MACs are not unless sticky is configured.
show port-security vs show port-security address
Both commands are used to examine port security features on Cisco switches, but they serve different scopes: 'show port-security' provides a per-interface summary of security status and violation counters, while 'show port-security address' lists the specific secure MAC addresses learned or configured on each port. They are often confused because users may not realize that the first command omits the actual MAC address table.
| Aspect | show port-security | show port-security address |
|---|---|---|
| Scope | Per-interface security status and violation counts | List of secure MAC addresses per interface |
| Output detail | Shows maximum addresses, current count, violation mode, action, and count | Shows MAC address, type (static/sticky/dynamic), port, and aging info |
| Configuration mode | Privileged EXEC | Privileged EXEC |
| Persistence | Reflects current runtime state | Reflects current secure MAC address table |
| Typical use | Verify if port security is enabled and check for violations | Inspect which MAC addresses are allowed and their aging settings |
Use show port-security when you need an overview of port security configuration and violation status across multiple interfaces.
Use show port-security address when you need to see the exact list of secure MAC addresses and verify which devices are currently authorized.
Platform Notes
In IOS-XE (e.g., Catalyst 3650/3850/9300), the 'show port-security' command syntax and output are very similar to classic IOS, but there may be additional fields like 'SecureUp' and 'Age' in the output. The NX-OS equivalent on Nexus switches is 'show port-security' as well, but the output format differs; for example, it shows 'Port Security Enabled' per interface and includes 'Secure MAC Address (Legacy)' fields. On Nexus, the configuration commands are also similar but use 'switchport port-security' under interface.
On ASA firewalls, port security is not directly applicable; instead, the ASA uses MAC address filtering in transparent mode. For IOS-XR, port security is not supported on most platforms; it is a Layer 2 feature primarily on Catalyst switches. Between IOS versions, the command has remained consistent from 12.x through 16.x, but newer versions may show additional details like 'Sticky MAC Addresses' and 'Last Violation Time'.
In IOS 15.x and later, the 'show port-security' command also supports the 'address' parameter to filter by MAC address. Always check the specific platform documentation for any nuances.
Related Commands
show port-security address
Displays the secure MAC addresses configured on all switch ports or a specific interface, used to verify port security address learning and aging.
show port-security interface [intf]
Displays port security configuration and status for a specific interface, including secure MAC addresses, violation counts, and action taken.
Practice for the CCNA 200-301
Test your knowledge with practice questions covering all CCNA 200-301 exam domains.
Practice CCNA 200-301 Questions