Securing Access Layer Switch Ports Using Cisco Port Security

Nerd Cafe | نرد کافه

1. Scenario Description

A small office network uses a Layer 2 switch to connect employees. The network administrator wants to prevent unauthorized devices from connecting to the switch.

Only specific devices (PCs) should be allowed on each switch port.

If an unauthorized device connects:

• The port should restrict traffic

• The violation should be logged

• The port should remain active for authorized devices

This is achieved using Port Security.

2. What is Port Security?

Port Security is a Cisco switch feature that:

• Limits number of MAC addresses allowed on a port

• Allows only authorized MAC addresses

• Prevents unauthorized device access

• Protects against MAC flooding attacks

Port Security Features

Feature	Description
Maximum MAC	Limits number of devices
Sticky MAC	Learns MAC automatically
Violation Mode	Action when violation occurs
Aging	Removes old MAC addresses

3. Network Topology

4. IP Address Table

Device	Interface	IP Address	Subnet Mask
Router	FA0/0	192.168.1.1	255.255.255.0
PC1	NIC	192.168.1.11	255.255.255.0
PC2	NIC	192.168.1.12	255.255.255.0
Switch	VLAN1	192.168.1.2	255.255.255.0

Default Gateway = 192.168.1.1

5. Configuration

Step 1 — Configure Router

Router>enable
Router#configure terminal 
Router(config)#interface fastEthernet 0/0
Router(config-if)#ip address 192.168.1.1 255.255.255.0
Router(config-if)#no shutdown 

Step 2 — Configure Switch Basic Settings

Switch>enable
Switch#configure terminal 
Switch(config)#interface vlan 1
Switch(config-if)#ip address 192.168.1.2 255.255.255.0
Switch(config-if)#no shutdown 
Switch(config-if)#exit
Switch(config)#ip default-gateway 192.168.1.1

6. Port Security Configuration

Configure Port Fa0/2 (PC1)

Allow only one device using Sticky MAC.

Switch(config)#interface fastEthernet 0/2
Switch(config-if)#switchport mode access 
Switch(config-if)#switchport port-security 
Switch(config-if)#switchport port-security maximum 1
Switch(config-if)#switchport port-security mac-address sticky 
Switch(config-if)#switchport port-security violation restrict 

Configure Port Fa0/3 (PC2)

Allow only one specific MAC address.

Example MAC:

  0001.963C.9629

So, we have:

Switch(config)#interface fastEthernet 0/3
Switch(config-if)#switchport mode access 
Switch(config-if)#switchport port-security 
Switch(config-if)#switchport port-security maximum 1
Switch(config-if)#switchport port-security mac-address 0001.963C.9629
Switch(config-if)#switchport port-security violation restrict

7. Verify Port Security

Command 1

Switch#show port-security 
Secure Port MaxSecureAddr CurrentAddr SecurityViolation Security Action
               (Count)       (Count)        (Count)
--------------------------------------------------------------------
        Fa0/2        1          0                 0         Restrict
        Fa0/3        1          1                 0         Restrict
----------------------------------------------------------------------
Switch#

Command 2

Switch#show port-security interface fa0/2
Port Security              : Enabled
Port Status                : Secure-up
Violation Mode             : Restrict
Aging Time                 : 0 mins
Aging Type                 : Absolute
SecureStatic Address Aging : Disabled
Maximum MAC Addresses      : 1
Total MAC Addresses        : 0
Configured MAC Addresses   : 0
Sticky MAC Addresses       : 0
Last Source Address:Vlan   : 0000.0000.0000:0
Security Violation Count   : 0

Switch#

Command 3

Switch#show port-security address 
			Secure Mac Address Table
-------------------------------------------------------------------------------
Vlan	Mac Address	Type			Ports		Remaining Age
								(mins)
----	-----------	----			-----		-------------
1	0001.963C.9629	SecureConfigured	FastEthernet0/3		-
------------------------------------------------------------------------------
Total Addresses in System (excluding one mac per port)     : 0
Max Addresses limit in System (excluding one mac per port) : 1024
Switch#

8. Operation Scenario

Normal Operation

Step1

PC1 connects to Fa0/2.

Switch learns MAC automatically:

Sticky MAC learned

Result:

• Port remains UP

• Communication works

• Ping succeeds

PC1>ping 192.168.1.1

Pinging 192.168.1.1 with 32 bytes of data:

Reply from 192.168.1.1: bytes=32 time=44ms TTL=255
Reply from 192.168.1.1: bytes=32 time=0ms TTL=255
Reply from 192.168.1.1: bytes=32 time=0ms TTL=255
Reply from 192.168.1.1: bytes=32 time=0ms TTL=255

Ping statistics for 192.168.1.1:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 0ms, Maximum = 44ms, Average = 11ms

PC>

9. Violation Scenario

Step 2

Disconnect PC1 and connect another PC.

Unauthorized PC MAC:

0007.EC07.9393

Result

Switch detects violation.

Security Violation Occurred

Violation Mode = Restrict

Result:

✔ Authorized MAC allowed ✖ Unauthorized MAC blocked ✔ Port stays up

Now, we have:

PC>ping 192.168.1.1

Pinging 192.168.1.1 with 32 bytes of data:

Request timed out.
Request timed out.
Request timed out.
Request timed out.

Ping statistics for 192.168.1.1:
    Packets: Sent = 4, Received = 0, Lost = 4 (100% loss),

PC>

10. Violation Modes Explained

Protect Mode

Switch(config-if)#switchport port-security violation protect

• Drops unauthorized traffic

• No logs

• No counter increase

Restrict Mode (Used Here)

Switch(config-if)#switchport port-security violation restrict

• Drops unauthorized traffic

• Logs violation

• Counter increases

Recommended mode.

Shutdown Mode

Switch(config-if)#switchport port-security violation shutdown

• Port goes into err-disabled

• Requires manual recovery

Output:

%PORT_SECURITY-2-PSECURE_VIOLATION

12. Recover Shutdown Port

Switch(config)#interface fastEthernet 0/2
Switch(config-if)#shutdown 
Switch(config-if)#no shutdown 

13. Advanced Configuration (Optional)

Enable Aging

Switch(config-if)#switchport port-security aging time 5
Sswitch(config-if)#switchport port-security aging type inactivity

Meaning:

• Remove MAC after 5 minutes of inactivity.

💖 Support Our Work

If you find this post helpful and would like to support my work, you can send a donation via TRC-20 (USDT). Your contributions help us keep creating and sharing more valuable content.

TRC-20 Address: TAAVVf9ZxUpbyvTa6Gd5SGPmctBdy4PQwf

Thank you for your generosity! 🙏

Keywords

Cisco Port Security, Layer 2 Security, Switch Security, MAC Address Filtering, Sticky MAC, Access Port Security, Cisco Switch Configuration, Network Security, Security Violation Modes, Protect Mode, Restrict Mode, Shutdown Mode, Secure MAC Addresses, Unauthorized Device Prevention, Access Layer Protection, Port Security Verification, MAC Address Learning, VLAN Access Ports, Cisco IOS Commands, Small Office Network Security, nerd cafe , نرد کافه

Channel Overview

🌐 Website: www.nerd-cafe.ir

📺 YouTube: @nerd-cafe

🎥 Aparat: nerd_cafe

📌 Pinterest: nerd_cafe

📱 Telegram: @nerd_cafe

📝 Blog: Nerd Café on Virgool

💻 GitHub: nerd-cafe