Configuring port security on Cisco IOS Switch

by Remy Pereira on 28th March 2015

Port security is one of the methods for restricting unauthorized access to your switch ports. By configuring port security you can make sure that only certain MAC addresses are allowed to connect to certain switch ports and if others are detected, these ports can be shutdown. However you should plan beforehand which ports are to be secured, how many MACs are allowed on these ports, should the MACs be static or dynamic and what action to perform if the restriction is violated. This feauture can typically be used if your switch is in a public area where it is possible for people to pull out cables and plug in to your switch ports etc. Also you can restict too many devices sharing connection to one of the switch ports by attaching to hubs or other dumb switches.

Port security can only be configured on access ports. By default port security is disabled. To turn it on, on any of the switch interfaces:

OTGSwitch(config)# interface Fa0/1
OTGSwitch(config-if)# switchport mode access
OTGSwitch(config-if)# switchport port-security

The default settings for port security are:

  • Maximum MAC Addresses : 1
  • Violation Mode : Shutdown
  • Aging Time : 0 mins
  • SecureStatic Address Aging : Disabled

i.e, Only one MAC address is allowed to connect to the port. If violation occurs then the port goes to shutdown (error-disabled) state. Aging is disabled and so learned MAC addresses do not expire even after the host is disconnected.

However you may want to modify the above default settings to suit your needs which is explained next.

Configure maximum MAC addresses

Sometimes you need a maximum of two devices to attach to a switch port. eg: PC and laptop.

OTGSwitch(config-if)# switchport port-security maximum 2

Configure violation mode

You can decide what action should be taken if violation is detected. Available modes are shutdown, restrict and protect. In protect mode only the traffic from authorized MACs are allowed and other traffic is blocked.

OTGSwitch(config-if)# switchport port-security violation protect

In restrict mode traffic is blocked and logs are generated.

OTGSwitch(config-if)# switchport port-security violation restrict

The default is shutdown mode where the port goes to error-disabled state. This will be the mode if violation mode is not explicitly specified.

OTGSwitch(config-if)# switchport port-security violation shutdown

Configure Aging

You can configure the switch to forget learned MAC addresses after sometime (regular interval or periods of inactivity). To set an aging time of 10 minutes of inactivity:

OTGSwitch(config-if)# switchport port-security aging time 10
OTGSwitch(config-if)# switchport port-security aging type inactivity

Configure static MAC addresses

To configure the MAC address that can attach to an interface

OTGSwitch(config-if)# switchport port-security mac-address 001a.a48d.d0d8

Configure MAC address learning

It is not practically possible to configure all the allowed MAC addresses for each port. An easier way is to let the switch learn the attached MAC addresses and keep in memory. These are called sticky MAC addresses and remain in the running configuration.

OTGSwitch(config-if)# switchport port-security mac-address sticky

The switch will dynamically learn addresses until the maximum number allowed is reached. To configure port security on multiple ports altogether, the configuration can be applied to multiple ports together if all settings are similar

OTGSwitch(config)# interface range fastEthernet 0/1 - 5
OTGSwitch(config-if)# switchport port-security

View port security status

To view port security status:

OTGSwitch# show port-security address
Secure Mac Address Table
Vlan Mac Address Type Ports Remaining Age
1 001a.a48d.d0d8 SecureDynamic Fa0/1 -

View port security settings on an interface

OTGSwitch# show port-security interface fa0/1

Port Security : Enabled
Port Status : Secure-up
Violation Mode : Shutdown
Aging Time : 0 mins
Aging Type : Absolute
SecureStatic Address Aging : Disabled
Maximum MAC Addresses : 1
Total MAC Addresses : 1
Configured MAC Addresses : 0
Sticky MAC Addresses : 0
Last Source Address : 001a.a48d.d0d8
Security Violation Count : 0

Post a comment


tom | January 2, 2019 2:54 AM |

Hi, I was told that if the mac address config on the port is set to sticky then the idea of that is that the address is saved to the start in nvram rather than the run as advised here, I was under the impression that selecting secure dynamic would save the learned address to the running config and be flushed if the switch was rebooted.

SD | February 17, 2017 10:39 AM |

This is the best port security explanation on the Internet. Well done

Robert Walton | June 13, 2016 8:05 PM |

I like these tutorials