What is Port Security?

Port Security is a Layer 2 security feature that restricts the MAC addresses that can use a switch port.

Without port security, a device with a valid Ethernet connection may potentially connect to an available switch port and attempt to access the network.

   Unauthorized PC
          |
          |
          v
   +-------------+
   |   Switch    |
   +-------------+
          |
    Network Access

          X

   Port Security
   can restrict
   which MAC addresses
   are allowed.
    

Port security can help reduce unauthorized access at the switch-port level.

Why is Port Security Important?

Consider an office where each desk has a dedicated switch port. An employee's computer is connected to a specific port.

    Employee PC
    MAC: AA:AA:AA:AA:AA:01
             |
             |
      +-------------+
      |   Switch    |
      +-------------+
             |
          Network
    

An administrator can configure the port to permit the expected MAC address and take action if another MAC address appears.

This provides an additional layer of protection at the access layer of the network.

MAC Address Limits

Port security allows administrators to specify the maximum number of secure MAC addresses permitted on a port.

For example, a port can be configured to allow only one secure MAC address.

```

Switch(config)# interface GigabitEthernet0/1
Switch(config-if)# switchport mode access
Switch(config-if)# switchport port-security
Switch(config-if)# switchport port-security maximum 1 

In this example, only one secure MAC address is allowed on the port.

Static Secure MAC Address

An administrator can manually configure a specific MAC address as a secure MAC address.

```

Switch(config)# interface GigabitEthernet0/1
Switch(config-if)# switchport port-security
Switch(config-if)# switchport port-security mac-address 00AA.11BB.22CC 

The switch will allow the configured MAC address on that port.

```

Allowed:

00AA.11BB.22CC
|
v
+-------------+
| Switch Port |
+-------------+

Different MAC
|
X
Violation 

What is Sticky MAC?

Sticky MAC allows the switch to dynamically learn MAC addresses and treat the learned addresses as secure MAC addresses.

This can reduce the need for an administrator to manually enter every MAC address.

```

PC connects
|
v
Switch learns MAC
|
v
Sticky MAC
|
v
MAC becomes secure 

Example:

```

Switch(config)# interface GigabitEthernet0/1
Switch(config-if)# switchport mode access
Switch(config-if)# switchport port-security
Switch(config-if)# switchport port-security mac-address sticky 

The switch can learn the MAC address and add it to the secure MAC address configuration.

Sticky MAC Example

```

PC1
MAC = AAAA.BBBB.CCCC
|
|
v
Gi0/1
|
v
+-------------+
|   Switch    |
|             |
| Sticky MAC  |
+-------------+

Learned:
AAAA.BBBB.CCCC 

If an unauthorized device later connects to the same port, the switch can treat the unexpected MAC address as a security violation according to the configured violation mode.

Port Security Violation Modes

Cisco provides different actions for situations where an unauthorized MAC address is detected.

• Protect
• Restrict
• Shutdown

Protect Mode

In Protect mode, frames from unauthorized MAC addresses are dropped.

The port remains operational and the switch does not normally generate the same level of security notifications associated with Restrict mode.

```

Known MAC
|
+----> Forward

Unknown MAC
|
+----> DROP 

Restrict Mode

In Restrict mode, unauthorized frames are dropped, while the switch can generate security-related notifications and increment violation counters.

```

Known MAC
|
+----> Forward

Unknown MAC
|
+----> DROP
|
+--> Counter / Notification 

Shutdown Mode

Shutdown is commonly used when stronger enforcement is required.

When a port-security violation occurs, the interface can be placed into an error-disabled state.

```

Unauthorized MAC
|
v
Violation
|
v
Port
|
v
ERR-DISABLED 

The interface must then be recovered according to the administrator's configuration and operational procedures.

Violation Mode Comparison

Complete Port Security Example

The following example configures a port to allow one sticky MAC address and use shutdown mode for a violation.

```

Switch(config)# interface GigabitEthernet0/1
Switch(config-if)# switchport mode access
Switch(config-if)# switchport port-security
Switch(config-if)# switchport port-security maximum 1
Switch(config-if)# switchport port-security mac-address sticky
Switch(config-if)# switchport port-security violation shutdown 

Verifying Port Security

Use the following Cisco commands to verify the configuration.

```

Switch# show port-security 

```

Switch# show port-security interface GigabitEthernet0/1 

```

Switch# show port-security address 

These commands can show secure MAC addresses, violation counts, maximum MAC limits, and port-security status.

Port Security and Sticky MAC in a Real Network

             Office Network

    Employee PC
    MAC: 1111.2222.3333
              |
              |
       +-------------+
       |   Switch    |
       |             |
       | Gi0/1       |
       |             |
       | Sticky MAC  |
       +-------------+
              |
              |
          Network


    Unauthorized PC
    MAC: 4444.5555.6666
              |
              X
         Violation
    

Port security can help ensure that an unexpected device does not freely use a protected access port.

Common Port Security Mistakes

1. Forgetting to configure the interface as an access port where required.
2. Setting the MAC address limit too low for the intended use.
3. Using sticky MAC without understanding how learned addresses are handled.
4. Choosing shutdown mode without a recovery procedure.
5. Not checking port-security violation counters.
6. Applying port security without considering special devices such as IP phones.

Easy Way to Remember

```

PORT SECURITY
|
+---- MAC Address Limit
|
+---- Static MAC
|
+---- Sticky MAC
|
+---- Violation Mode
|
+-- Protect
+-- Restrict
+-- Shutdown 

Practical Packet Tracer Lab

1. Create a Cisco switch and connect a PC.
2. Configure the PC-facing interface as an access port.
3. Enable port security.
4. Set the maximum secure MAC addresses to one.
5. Enable sticky MAC learning.
6. Configure the violation mode as shutdown.
7. Connect another device and observe the security violation.
8. Use show port-security interface to inspect the status.

Quiz

Question: What feature allows a Cisco switch to dynamically learn a MAC address and use it as a secure MAC address?

Bonus Question: Which violation mode can place the interface into an error-disabled state?

Key Takeaways

• Port Security controls which MAC addresses can use a switch port.
• You can configure a maximum number of secure MAC addresses.
• MAC addresses can be configured manually.
• Sticky MAC allows the switch to learn secure MAC addresses dynamically.
• Protect drops unauthorized traffic while keeping the port active.
• Restrict drops unauthorized traffic and records violation information.
• Shutdown can place a violating port into an error-disabled state.
• Port-security verification commands help identify violations and secure MAC addresses.