show port-security interface [intf]
Displays port security configuration and status for a specific interface, including secure MAC addresses, violation counts, and action taken.
Definition: show port-security interface [intf] is a Cisco IOS privileged exec command. Displays port security configuration and status for a specific interface, including secure MAC addresses, violation counts, and action taken.
Overview
The `show port-security interface` command is a vital diagnostic tool in Cisco IOS for verifying and troubleshooting port security configurations on a per-interface basis. Port security is a Layer 2 security feature that restricts input to a switch port by limiting the MAC addresses allowed to send traffic. This command displays the current port security settings, including the maximum number of secure MAC addresses allowed, the current count of secure MAC addresses, the violation count, and the action taken when a violation occurs (e.g., shutdown, restrict, or protect).
It also lists the secure MAC addresses learned or configured on the interface, along with their type (static, dynamic, or sticky) and aging status. Network engineers reach for this command when they need to confirm that port security is correctly applied, investigate why a port is err-disabled, or audit which devices are connected to a specific port. Unlike `show running-config interface`, which shows only the configuration, `show port-security interface` provides operational state, making it essential for real-time troubleshooting.
It fits into the broader workflow of securing access ports in enterprise networks, often used after configuring `switchport port-security` to validate the setup, or when a user reports connectivity loss due to a security violation. Important IOS behavior: the command requires privileged EXEC mode (enable) and does not affect the running configuration. Output is buffered and may be truncated if the terminal length is set; use `terminal length 0` to disable paging.
The command is available in IOS 12.x and later, including IOS-XE, but not in NX-OS (which uses `show port-security` with interface filtering) or IOS-XR (which does not support port security). Understanding the output helps engineers quickly identify misconfigurations, such as an interface with too few allowed MAC addresses for a VoIP phone and PC, or a port that has been err-disabled due to a violation. The command also reveals whether sticky MAC learning is enabled, which dynamically converts learned MACs to secure addresses.
Overall, `show port-security interface` is indispensable for maintaining network security and availability in campus LAN environments.
show port-security interface [intf]When to Use This Command
- Verify that port security is enabled and configured correctly on an access port connected to a known device.
- Troubleshoot a port that has been err-disabled due to a security violation by checking the violation count and last source MAC.
- Audit which MAC addresses are currently learned on a secure port and whether they are static or dynamic.
- Confirm that the maximum number of secure MAC addresses has not been exceeded on a trunk port with port security enabled.
Parameters
| Parameter | Syntax | Description |
|---|---|---|
| interface | interface-type interface-number | Specifies the switch interface to display port security information for. Valid interface types include FastEthernet, GigabitEthernet, and TenGigabitEthernet (e.g., GigabitEthernet0/1). The interface must exist on the switch. A common mistake is omitting the interface type or using an incorrect slot/port number, which results in an 'Invalid interface' error. |
Command Examples
Basic usage on a secure access port
show port-security interface gigabitethernet 0/1Port Security : Enabled Port Status : Secure-up Violation Mode : Shutdown Aging Time : 0 mins Aging Type : Absolute SecureStatic Address Aging : Disabled Maximum MAC Addresses : 1 Total MAC Addresses : 1 Configured MAC Addresses : 0 Sticky MAC Addresses : 0 Last Source Address:Vlan : 0050.7966.6800:10 Security Violation Count : 0
Port Security: Enabled means port security is active. Port Status: Secure-up indicates the port is up and no violation. Violation Mode: Shutdown means the port will be err-disabled on violation. Maximum MAC Addresses: 1 means only one MAC allowed. Total MAC Addresses: 1 shows one MAC learned. Last Source Address:Vlan shows the last source MAC and VLAN. Security Violation Count: 0 means no violations.
Port in err-disabled state due to violation
show port-security interface fastethernet 0/2Port Security : Enabled Port Status : Secure-shutdown Violation Mode : Shutdown Aging Time : 0 mins Aging Type : Absolute SecureStatic Address Aging : Disabled Maximum MAC Addresses : 2 Total MAC Addresses : 2 Configured MAC Addresses : 1 Sticky MAC Addresses : 0 Last Source Address:Vlan : 0011.2233.4455:20 Security Violation Count : 3
Port Status: Secure-shutdown indicates the port is err-disabled due to a violation. Security Violation Count: 3 shows three violations occurred. Last Source Address:Vlan shows the MAC that caused the last violation. Total MAC Addresses: 2 equals the maximum, meaning the port learned the maximum allowed addresses before the violation.
Understanding the Output
The output shows the port security status and configuration for the specified interface. 'Port Security' indicates whether the feature is enabled. 'Port Status' shows the current state: 'Secure-up' means normal operation, 'Secure-shutdown' means the port has been disabled due to a violation, and 'Secure-down' means the line protocol is down.
'Violation Mode' displays the configured action (shutdown, restrict, or protect). 'Aging Time' and 'Aging Type' relate to MAC address aging. 'Maximum MAC Addresses' is the configured limit.
'Total MAC Addresses' shows how many MACs are currently learned. 'Configured MAC Addresses' are statically defined, and 'Sticky MAC Addresses' are dynamically learned and saved to running config. 'Last Source Address:Vlan' shows the most recent source MAC and VLAN that triggered a violation or was learned.
'Security Violation Count' increments each time a violation occurs; a high count indicates repeated issues. In a real network, a violation count greater than 0 with 'Secure-shutdown' status requires manual intervention (shut/no shut) to recover the port. A 'Secure-up' status with zero violations is the desired state.
Configuration Scenarios
Verify Port Security on an Access Port for a Single PC
A network administrator has configured port security on an access port connecting a single PC to prevent unauthorized devices from connecting. They need to verify that the configuration is correct and that the PC's MAC address has been learned securely.
Topology
PC1---(Fa0/1)SW1Steps
- 1.Step 1: Enter privileged EXEC mode: SW1> enable
- 2.Step 2: Run the show command: SW1# show port-security interface fastEthernet 0/1
! Configuration on SW1 interface Fa0/1 interface FastEthernet0/1 switchport mode access switchport port-security switchport port-security maximum 1 switchport port-security mac-address sticky switchport port-security violation shutdown
Verify: SW1# show port-security interface fastEthernet 0/1 Port Security : Enabled Port Status : Secure-up Violation Mode : Shutdown Aging Time : 0 mins Aging Type : Absolute SecureStatic Address Aging : Disabled Maximum MAC Addresses : 1 Total MAC Addresses : 1 Configured MAC Addresses : 0 Sticky MAC Addresses : 1 Last Source Address:Vlan : 0050.7966.6800:1 Security Violation Count : 0
Watch out: If the PC is not sending traffic, the sticky MAC address may not appear. Ensure the PC is connected and generating traffic (e.g., ping the default gateway) before verifying.
Troubleshoot an Err-Disabled Port Due to Port Security Violation
A user reports that their switch port is down. The network engineer suspects a port security violation has occurred, causing the port to enter err-disabled state. They need to confirm the violation and determine the offending MAC address.
Topology
UnauthorizedDevice---(Fa0/2)SW1---(Trunk)SW2Steps
- 1.Step 1: Enter privileged EXEC mode: SW1> enable
- 2.Step 2: Check the interface status: SW1# show interfaces fastEthernet 0/2 status
- 3.Step 3: If err-disabled, run port security check: SW1# show port-security interface fastEthernet 0/2
! Configuration on SW1 interface Fa0/2 interface FastEthernet0/2 switchport mode access switchport port-security switchport port-security maximum 2 switchport port-security violation shutdown switchport port-security mac-address sticky
Verify: SW1# show port-security interface fastEthernet 0/2 Port Security : Enabled Port Status : Secure-shutdown Violation Mode : Shutdown Aging Time : 0 mins Aging Type : Absolute SecureStatic Address Aging : Disabled Maximum MAC Addresses : 2 Total MAC Addresses : 2 Configured MAC Addresses : 0 Sticky MAC Addresses : 2 Last Source Address:Vlan : 0a1b.2c3d.4e5f:1 Security Violation Count : 1 The 'Port Status' shows 'Secure-shutdown' and 'Security Violation Count' is 1, indicating a violation occurred. The 'Last Source Address' shows the MAC that caused the violation.
Watch out: After a violation, the port is err-disabled. To recover, you must manually shut and no shut the interface, or configure errdisable recovery cause psecure-violation. Simply re-enabling the port without addressing the unauthorized device will cause another violation.
Troubleshooting with This Command
When troubleshooting port security issues, the `show port-security interface` command is your primary tool. Healthy output shows 'Port Status: Secure-up', 'Security Violation Count: 0', and the total MAC addresses should be less than or equal to the configured maximum. Problem indicators include 'Port Status: Secure-shutdown' or 'Secure-violation', and a non-zero violation count.
Focus on the 'Last Source Address:Vlan' field, which reveals the MAC address that triggered the violation. This helps identify whether an unauthorized device attempted to connect or if a legitimate device's MAC address changed (e.g., due to NIC replacement). Common symptoms this command diagnoses include: a port that goes down intermittently (violation count increments), a port stuck in err-disabled state, or a port that fails to learn the expected MAC addresses.
The step-by-step diagnostic flow: 1) Check interface status with `show interfaces status` or `show interfaces` to confirm err-disabled. 2) Run `show port-security interface` to see violation count and last source address. 3) If violation count > 0, determine if the MAC is legitimate. If not, remove the unauthorized device. 4) To recover, use `shutdown` followed by `no shutdown` on the interface, or configure errdisable recovery. 5) If the violation persists, consider increasing the maximum MAC addresses or using 'sticky' learning to dynamically allow known devices. Correlate this command's output with `show mac address-table interface` to see all learned MACs on the port, and `show logging` to see violation messages (e.g., '%PORT_SECURITY-2-PSECURE_VIOLATION').
Also, `debug port-security` can provide real-time violation events, but use with caution in production. Remember that port security only applies to access ports; trunk ports are not supported. If you see 'Port Security: Disabled' when you expected it enabled, verify the interface mode and that port security is configured under the interface.
Finally, note that the 'Aging Time' and 'Aging Type' fields indicate whether secure MAC addresses expire; if aging is disabled (0 mins), addresses remain indefinitely until the port is cleared or the switch reloads.
CCNA Exam Tips
Remember that the default violation mode is 'shutdown', which err-disables the port; the exam may ask how to recover (shut/no shut).
Know that 'sticky' MAC addresses are saved to running config and become like static entries; they survive reloads only if config is saved.
The 'maximum MAC addresses' default is 1; the exam may test that you can increase it to allow multiple devices.
Be able to distinguish between 'shutdown', 'restrict', and 'protect' violation modes: shutdown disables the port, restrict drops frames and logs, protect drops frames without logging.
Common Mistakes
Forgetting to enable port security globally with 'switchport port-security' after configuring interface-level commands.
Assuming that 'sticky' MAC addresses are automatically saved to startup-config; they are only in running-config until you copy.
Setting the maximum MAC addresses too low for a trunk port, causing legitimate traffic to be dropped as violations.
Not realizing that a port in err-disabled state due to security violation must be manually re-enabled with 'shutdown' followed by 'no shutdown'.
show port-security interface [intf] vs show port-security
Both commands display port security information but differ in scope. 'show port-security interface [intf]' focuses on a single interface, while 'show port-security' provides a global summary. They are often confused because admins may not realize the level of detail varies by command.
| Aspect | show port-security interface [intf] | show port-security |
|---|---|---|
| Scope | Single interface only | All interfaces or summary |
| Output Detail | Detailed per-interface (MACs, violations, action) | Summary per-interface (max MACs, current count, violations) |
| Syntax Requirement | Requires interface argument | No argument; optional interface keyword not supported |
| Typical Use | Troubleshooting a specific port | Quickly assessing overall port security status |
Use show port-security interface [intf] when you need detailed port security info for a specific interface, such as seeing all secure MAC addresses and violation counts.
Use show port-security when you want a high-level overview of port security across all interfaces, including the number of secure MACs and violations per port.
Platform Notes
In IOS-XE (e.g., Catalyst 9000 series), the syntax and output of `show port-security interface` are nearly identical to classic IOS. However, IOS-XE may include additional fields such as 'Secure MAC Addresses (count)' and 'Sticky MAC Addresses (count)' in a slightly different format. For NX-OS (e.g., Nexus switches), port security is configured differently and the equivalent command is `show port-security interface [interface]`.
The output includes similar information but uses different terminology (e.g., 'Secure MAC Address' vs 'Secure MAC Addresses'). NX-OS also supports port security on trunk ports, unlike IOS. For ASA firewalls, port security is not applicable as they operate at Layer 3/4.
In IOS-XR, port security is not supported; instead, use features like MAC limiting or DHCP snooping for similar functionality. Between IOS versions, the command has remained consistent from 12.x through 15.x and 16.x, though newer versions may add fields like 'SecureStatic Address Aging' or 'Violation Mode'. Always check the specific platform documentation for any nuances.
For example, on older 2960 switches running IOS 12.2, the output may not show 'Aging Type' or 'SecureStatic Address Aging'. On Catalyst 3850 running IOS-XE 16.x, the output includes 'Port Security: Enabled' and 'Port Status: SecureUp' (no hyphen). When migrating from classic IOS to IOS-XE, the command behavior is backward-compatible, but output formatting may differ slightly.
For automation scripts, use `show port-security interface | json` on IOS-XE to get JSON output.
Related Commands
show port-security
Displays the port security configuration and status on switch interfaces, used to verify and troubleshoot port security settings.
show port-security address
Displays the secure MAC addresses configured on all switch ports or a specific interface, used to verify port security address learning and aging.
Practice for the CCNA 200-301
Test your knowledge with practice questions covering all CCNA 200-301 exam domains.
Practice CCNA 200-301 Questions