Port Security on a Cisco Switch — Configuration, Violation Modes and Recovery

Port security restricts which MAC addresses are allowed on a switch port and how many. If an unexpected device connects, the switch takes an action you define — drop its traffic, log it, or shut the port down.

It defends against two things specifically: someone unplugging an authorised device and connecting their own, and MAC flooding, where an attacker fills the switch’s MAC address table so it starts flooding all traffic out of every port and can be captured.

Configuring Port Security

The port must be a static access or trunk port first — port security cannot be enabled on a port left in dynamic (DTP-negotiating) mode.

Switch(config)# interface GigabitEthernet0/5
Switch(config-if)# switchport mode access
Switch(config-if)# switchport access vlan 10
Switch(config-if)# switchport port-security
Switch(config-if)# switchport port-security maximum 2
Switch(config-if)# switchport port-security mac-address sticky
Switch(config-if)# switchport port-security violation restrict
Switch(config-if)# switchport port-security aging time 60
Switch(config-if)# switchport port-security aging type inactivity

Sticky learning is the practical option for a real deployment. Manually entering hundreds of MAC addresses does not scale; sticky learns whatever is plugged in now and locks the port to it. Remember to write memory — sticky addresses go into the running config, and are lost on reload if not saved.

The Three Violation Modes

protect is almost never the right choice — it fails silently, so you find out about the problem from a user rather than from monitoring.

restrict is usually the best balance: the unauthorised device is blocked, the authorised one keeps working, and you get an alert.

shutdown is the default and the strictest. It also means anyone who plugs the wrong laptop into a wall port takes that port offline until someone re-enables it — which generates a lot of helpdesk work unless you configure automatic recovery.

Recovering an Err-Disabled Port

When a port goes err-disabled, it stays down until manually cleared:

Switch(config)# interface GigabitEthernet0/5
Switch(config-if)# shutdown
Switch(config-if)# no shutdown

Or configure the switch to recover on its own:

Switch(config)# errdisable recovery cause psecure-violation
Switch(config)# errdisable recovery interval 300

The port comes back automatically after 300 seconds. If the offending device is still connected, it will trip again — which is the correct behaviour.

Verification Commands

Switch# show port-security
Switch# show port-security interface GigabitEthernet0/5
Switch# show port-security address
Switch# show interfaces status err-disabled
Switch# show errdisable recovery

show port-security interface is the one to run first — it shows the violation mode, maximum, current count, last violating MAC address, and the violation counter.

Port Security with an IP Phone

A phone with a PC daisy-chained behind it puts two MAC addresses on one port, across two VLANs:

Switch(config-if)# switchport mode access
Switch(config-if)# switchport access vlan 10
Switch(config-if)# switchport voice vlan 20
Switch(config-if)# switchport port-security maximum 3
Switch(config-if)# switchport port-security maximum 2 vlan access
Switch(config-if)# switchport port-security maximum 1 vlan voice
Switch(config-if)# switchport port-security violation restrict
Switch(config-if)# switchport port-security mac-address sticky

Setting a global maximum of 1 on a voice port is a common mistake — the phone alone consumes the entry and the PC behind it is blocked.

Port Security vs 802.1X

Be honest about what port security achieves. A MAC address is visible to anyone on the segment and can be changed with one command on any operating system. Port security stops casual unauthorised connections and MAC flooding; it does not stop a motivated attacker. 802.1X is the real access control, and port security is the pragmatic option when you do not have RADIUS.

Deploying It Without Causing an Outage

1. Start with violation restrict, not shutdown. Watch the logs for a week before tightening.
2. Use sticky learning during a normal working day so genuine devices get learned.
3. Set maximum realistically — 2 or 3, not 1, since docking stations, hypervisors and virtual machines all present extra MAC addresses.
4. Never enable it on uplinks or trunks between switches. Those legitimately carry hundreds of MAC addresses.
5. Configure errdisable recovery so a mistake does not require a site visit.
6. Save the config, or your sticky addresses vanish on reload.

Related Layer 2 Protections

• Dynamic ARP Inspection — blocks ARP poisoning
• DHCP snooping — blocks rogue DHCP servers
• IP Source Guard — blocks IP spoofing from a host
• BPDU Guard — blocks rogue switches injecting STP

These are complementary; deployed together on access ports they close most of the Layer 2 attack surface. See the full switching guide.

Frequently Asked Questions

What is the default port security configuration?

Once switchport port-security is entered: maximum 1 MAC address, violation mode shutdown, dynamic learning with no ageing. The very first device to connect claims the port.

Why did my port go err-disabled?

A violation occurred — more MAC addresses than the maximum, or an address not in the allowed list. Run show port-security interface to see the last violating MAC, then shutdown / no shutdown to recover.

Can port security be used on trunk ports?

Technically yes, but it is a bad idea. A trunk to another switch carries every MAC address behind it, so any sensible maximum is either useless or will shut the link down.

Does port security stop MAC spoofing?

No. An attacker who observes an authorised MAC address can set their own interface to match it and the switch will accept it. Port security raises the effort slightly; 802.1X is the actual control.

What is the difference between sticky and static MAC addresses?

Static addresses are typed in by hand. Sticky addresses are learned automatically and then written into the running configuration, giving the same result with far less work — provided you save the config.

How many MAC addresses can one port allow?

Platform dependent, commonly up to 132 or more per port, with a switch-wide limit set by the SDM template in use. For access ports the practical answer is 2 or 3.