Port Security on Cisco Switches: Sticky MAC and Violation Modes

An open switch port is an open door: anyone can plug in a laptop, a personal Wi-Fi router or an extra switch and join your network. Port sec...

An open switch port is an open door: anyone can plug in a laptop, a personal Wi-Fi router or an extra switch and join your network. Port security lets a Cisco switch decide which MAC addresses may use each access port and what happens when an unknown device appears. In this Packet Tracer lab you will configure port security with sticky MAC learning, then trigger all three violation modes (protect, restrict and shutdown) and see how each one behaves.

How port security works

When port security is enabled on an interface, the switch keeps a list of "secure" MAC addresses for that port and a maximum number allowed (default 1). Frames from secure addresses are forwarded normally. When a frame arrives from a new MAC address and the port has already reached its maximum, that is a violation, and the switch reacts according to the violation mode.

Secure MAC addresses can be learned in three ways:

Type	How it is learned	Saved in running-config?	Survives reload?
Static	You type it with switchport port-security mac-address H.H.H	Yes	Yes, if you save the config
Dynamic	Learned from traffic	No	No, relearned after reload
Sticky	Learned from traffic, then written into the running-config	Yes	Yes, if you save the config

Sticky learning gives you the best of both: you do not have to collect MAC addresses by hand, but once learned they are locked in like static entries.

The three violation modes

Mode	Drops unknown frames	Log / SNMP message	Violation counter increases	Port shuts down
protect	Yes	No	No	No
restrict	Yes	Yes	Yes	No
shutdown (default)	Yes	Yes	Yes	Yes, err-disabled

Lab topology

One 2960 switch with three office PCs and one extra laptop that will play the role of an unauthorized device. All devices are in VLAN 1 for simplicity.

Figure: Port security lab with one violation mode per port (all devices in VLAN 1)

Device	Switch port	IP address	MAC address (example)
PC1	Fa0/1	192.168.1.11/24	0001.6421.3A01
PC2	Fa0/2	192.168.1.12/24	00D0.BC55.2A02
PC3	Fa0/3	192.168.1.13/24	0060.2F84.1C03
Rogue-Laptop	moved between ports	192.168.1.50/24	0090.2B7C.4D04
SW1	VLAN 1	192.168.1.2/24	-

Your devices will have different MAC addresses. Check each PC under Config > FastEthernet0, or run ipconfig /all from its command prompt, and note them down.

Step 1: Configure Fa0/1 with sticky MAC and shutdown mode

SW1(config)# interface fastEthernet0/1
SW1(config-if)# switchport mode access
SW1(config-if)# switchport port-security
SW1(config-if)# switchport port-security maximum 1
SW1(config-if)# switchport port-security mac-address sticky
SW1(config-if)# switchport port-security violation shutdown

• switchport mode access is mandatory. Port security is refused on a port in the default dynamic mode (see Common mistakes).
• switchport port-security actually turns the feature on. Without this line, the other port-security commands sit in the config doing nothing.
• maximum 1 and violation shutdown are the defaults, but I always type them so the intent is visible in the configuration.
• mac-address sticky tells the switch to learn the first MAC it sees and save it.

Step 2: Fa0/2 with restrict mode and maximum 2

A common real case is an IP phone with a PC behind it, which needs two MAC addresses on one port. We will simulate that with a maximum of 2 and the restrict mode.

SW1(config)# interface fastEthernet0/2
SW1(config-if)# switchport mode access
SW1(config-if)# switchport port-security
SW1(config-if)# switchport port-security maximum 2
SW1(config-if)# switchport port-security mac-address sticky
SW1(config-if)# switchport port-security violation restrict

Step 3: Fa0/3 with protect mode

SW1(config)# interface fastEthernet0/3
SW1(config-if)# switchport mode access
SW1(config-if)# switchport port-security
SW1(config-if)# switchport port-security mac-address sticky
SW1(config-if)# switchport port-security violation protect

Step 4: Let the switch learn the MAC addresses

Sticky learning only happens when the switch sees a frame. From each PC, ping another PC (for example PC1 to 192.168.1.12, PC3 to 192.168.1.11). Then check the running configuration:

SW1# show running-config interface fastEthernet0/1
Building configuration...

!
interface FastEthernet0/1
 switchport mode access
 switchport port-security
 switchport port-security mac-address sticky
 switchport port-security mac-address sticky 0001.6421.3A01
!
end

The second sticky line was added by the switch. The maximum 1 and violation shutdown lines do not appear because they are defaults; on Fa0/2 you will see maximum 2 and violation restrict. The learned MAC is only in the running-config, so save it:

SW1# copy running-config startup-config

Verification

SW1# show port-security
Secure Port MaxSecureAddr CurrentAddr SecurityViolation Security Action
               (Count)       (Count)          (Count)
--------------------------------------------------------------------
        Fa0/1        1          1                 0         Shutdown
        Fa0/2        2          1                 0         Restrict
        Fa0/3        1          1                 0         Protect
----------------------------------------------------------------------

SW1# show port-security address
               Secure Mac Address Table
-----------------------------------------------------------------------------
Vlan    Mac Address       Type                          Ports   Remaining Age
                                                                   (mins)
----    -----------       ----                          -----   -------------
   1    0001.6421.3A01    SecureSticky                  Fa0/1        -
   1    00D0.BC55.2A02    SecureSticky                  Fa0/2        -
   1    0060.2F84.1C03    SecureSticky                  Fa0/3        -
-----------------------------------------------------------------------------

SW1# show port-security interface fastEthernet0/1
Port Security              : Enabled
Port Status                : Secure-up
Violation Mode             : Shutdown
Aging Time                 : 0 mins
Aging Type                 : Absolute
SecureStatic Address Aging : Disabled
Maximum MAC Addresses      : 1
Total MAC Addresses        : 1
Configured MAC Addresses   : 0
Sticky MAC Addresses       : 1
Last Source Address:Vlan   : 0001.6421.3A01:1
Security Violation Count   : 0

Fa0/2 shows one address because only PC2 is connected; it has room for one more.

Step 5: Trigger the violations

Shutdown mode (Fa0/1)

Disconnect PC1 from Fa0/1 and connect Rogue-Laptop to Fa0/1 instead. Ping 192.168.1.12 from the laptop. The first frame from 0090.2B7C.4D04 is a violation:

%LINK-3-UPDOWN: Interface FastEthernet0/1, changed state to down
%LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/1, changed state to down

On real IOS you also see %PM-4-ERR_DISABLE: psecure-violation error detected on Fa0/1, putting Fa0/1 in err-disable state and a %PORT_SECURITY-2-PSECURE_VIOLATION message naming the offending MAC. Exact log text varies between Packet Tracer and IOS releases. Check the result:

SW1# show port-security interface fastEthernet0/1
Port Security              : Enabled
Port Status                : Secure-shutdown
Violation Mode             : Shutdown
...output trimmed...
Last Source Address:Vlan   : 0090.2B7C.4D04:1
Security Violation Count   : 1

SW1# show interfaces fastEthernet0/1 status
Port      Name               Status       Vlan       Duplex  Speed Type
Fa0/1                        err-disabled 1          auto    auto  10/100BaseTX

To recover, remove the rogue device, reconnect PC1, and bounce the port:

SW1(config)# interface fastEthernet0/1
SW1(config-if)# shutdown
SW1(config-if)# no shutdown

On real switches you can let the port recover by itself after a delay with errdisable recovery cause psecure-violation and errdisable recovery interval 300. If the rogue device is still connected, the port simply goes down again.

Restrict mode (Fa0/2)

Fa0/2 allows two addresses. Put a hub (Hub-PT in Packet Tracer) between Fa0/2 and PC2, then connect both PC2 and Rogue-Laptop to it. The laptop becomes the second learned address and works. Now add a third PC (192.168.1.51/24) to the hub and ping from it. Its frames are dropped, the port stays up, PC2 keeps working, and the counter rises:

SW1# show port-security interface fastEthernet0/2
Port Security              : Enabled
Port Status                : Secure-up
Violation Mode             : Restrict
...output trimmed...
Maximum MAC Addresses      : 2
Total MAC Addresses        : 2
Sticky MAC Addresses       : 2
Security Violation Count   : 4

The count increases for every violating frame, so it can climb quickly. Restrict is a good choice where you cannot afford to cut off a legitimate user but still want to be alerted.

Protect mode (Fa0/3)

Repeat the hub test on Fa0/3. The extra device cannot communicate, but there is no log message and the violation count stays at 0. Protect is silent, which makes it hard to troubleshoot. I rarely use it.

If you run all three tests without recovering Fa0/1 first (bouncing the port resets its counter), the summary shows each mode's result side by side:

SW1# show port-security
Secure Port MaxSecureAddr CurrentAddr SecurityViolation Security Action
               (Count)       (Count)          (Count)
--------------------------------------------------------------------
        Fa0/1        1          1                 1         Shutdown
        Fa0/2        2          2                 4         Restrict
        Fa0/3        1          1                 0         Protect
----------------------------------------------------------------------

Fa0/1 counted one violation and went err-disabled, Fa0/2 is full and still counting, and Fa0/3 shows 0 even though it dropped the extra device's frames.

Prefer video? Watch more hands-on labs on the Technical Hakim YouTube channel.

Removing or changing a sticky address

If PC1 is replaced, its old MAC is still locked to Fa0/1. Remove it with the no form of the sticky line, then save:

SW1(config)# interface fastEthernet0/1
SW1(config-if)# no switchport port-security mac-address sticky 0001.6421.3A01

On real IOS, clear port-security sticky interface fastEthernet0/1 does the same from privileged EXEC mode.

Common mistakes

• "Command rejected: FastEthernet0/1 is a dynamic port." You tried to enable port security before setting switchport mode access. 2960 ports default to dynamic auto.
• Forgetting switchport port-security. The maximum, sticky and violation commands are accepted, but nothing is enforced. show port-security interface shows "Port Security : Disabled".
• Not saving after sticky learning. Sticky addresses live in the running-config. After a reload without copy running-config startup-config, they are gone and the switch learns whichever device plugs in first.
• Maximum too low for phones or virtual machines. An IP phone plus PC needs at least 2; a laptop running VMs in bridged mode can present several MACs.
• Expecting protect mode to show violations. It never increments the counter. Use restrict if you want visibility.
• Treating port security as full access control. MAC addresses can be spoofed. Port security is a useful first layer; 802.1X is the proper solution for authenticating devices.

Summary

You enabled port security on three access ports, used sticky learning to lock in each PC's MAC address, and tested all three violation modes: shutdown err-disables the port, restrict drops and logs, and protect drops silently. Verify with show port-security, show port-security address and show port-security interface, and always save the configuration after sticky addresses are learned.

Related tutorials

• Configuring Static VLANs on a Cisco Switch (Packet Tracer Lab)
• Spanning Tree Protocol Basics: Root Bridge Election in a Lab
• Basic Cisco Router Setup: Hostname, Passwords, Banner and SSH
• Standard vs Extended ACLs on Cisco Routers: Lab with Examples

Sources

• Cisco Catalyst 2960 Switch Software Configuration Guide – Configuring Port-Based Traffic Control (Port Security)
• Cisco Catalyst 2960 Switch Command Reference – switchport port-security
• IEEE 802.1X – Port-Based Network Access Control