Securing Switch Ports with Port Security

Before you can enable port security on any Cisco switch interface, you must explicitly configure that port as an access port using the command switchport mode access.

By default, Cisco switch ports operate in dynamic desirable or dynamic auto mode under the Dynamic Trunking Protocol (DTP). This allows them to negotiate 802.1Q trunking automatically if a neighboring switch connects.

Cisco IOS intentionally disables port security on dynamic or trunking interfaces because trunk links carry thousands of different MAC addresses from multiple VLANs. Explicitly locking the port into access mode guarantees that the interface is dedicated to a single client endpoint.

Once static access mode is locked in, enter the feature activation command switchport port-security. This turns on the security inspection engine for interface FastEthernet0/1.

Parameter-by-Parameter Command Breakdown:

Network administrators have three ways to define allowed MAC addresses: static manual typing, dynamic memory learning, and Sticky MAC learning.

Manually typing twelve-character hexadecimal MAC addresses for hundreds of workstations across a campus is exhausting and prone to human typos. Dynamic memory learning forgets all addresses the second the switch reboots.

Sticky MAC learning provides the perfect operational balance. When you execute switchport port-security mac-address sticky, the switch observes the very first frame sent by the connected computer, learns its hardware MAC address automatically, and writes it directly into the running configuration.

Next, configure switchport port-security maximum 1. This restricts the port to exactly one authorized hardware device. If an employee connects a mini-switch under their desk to share their wall jack with a friend, the arrival of a second MAC address will trigger a security violation.

How Sticky Learning Saves Administrative Time:

Cisco switches support three distinct security violation modes: Protect, Restrict, and Shutdown.

Each violation mode applies a different level of defensive action when an unauthorized source MAC address reaches the port:

The port remains completely disabled to both the intruder and the original user until an authorized network administrator logs into the console, investigates the incident, and manually resets the interface.

Violation Mode Defense Matrix:

In corporate offices, shutdown is strongly preferred because it visually alerts users with a dead link light and prevents attackers from attempting brute-force MAC spoofing.

To test our defense policy in Simneta NetLab, generate normal traffic from the Authorized Workstation by pinging the switch IP. Open the switch CLI and confirm that FastEthernet0/1 has successfully recorded the workstation MAC address.

Now, disconnect the Authorized Workstation from port Fa0/1 and plug in the Rogue Attacker Laptop. Attempt to transmit a ping from the rogue machine.

Watch how the switch hardware responds within milliseconds to block the untrusted computer.

Analyzing the Err-Disable State:

Once a port enters the err-disabled state, simply unplugging the rogue laptop and plugging the authorized workstation back in will not restore connectivity. The switch ASIC locks the port in hardware to prevent attackers from retrying different spoofed addresses.

To recover the port, an administrator must access the switch console, navigate to the affected interface, execute shutdown, and then execute no shutdown.

Review the recovery sequence to return the port to active production service.

How Interface Cycling Clears the Hardware Latch: