What does port security do, and what are its three violation modes?
Show the answer
Say this first
Port security limits how many, and optionally which, source MAC addresses an access port accepts. The default maximum is one MAC and the default violation mode is shutdown. Protect silently drops frames from the extra MACs. Restrict drops them, increments the violation counter and sends a syslog message and SNMP trap. Shutdown puts the port into err-disabled, which stops all traffic until the port is recovered.
Go deeper
Configuration
interface GigabitEthernet1/0/5
switchport mode access
switchport access vlan 10
switchport port-security maximum 2
switchport port-security mac-address sticky
switchport port-security violation restrict
switchport port-securityThe port must be a static access or trunk port. On a port left in a dynamic DTP mode the command is rejected. Sticky learning writes learned MACs into the running config, so save it to keep them.
The modes
| Mode | Drops the frame | Syslog and SNMP | Violation counter | Port |
|---|---|---|---|---|
| protect | yes | no | no | stays up |
| restrict | yes | yes | yes | stays up |
| shutdown (default) | yes | yes | yes | err-disabled |
| shutdown vlan | yes | yes | yes | only the offending VLAN disabled |
%PORT_SECURITY-2-PSECURE_VIOLATION: Security violation occurred, caused by MAC address 0050.5689.0bad on port GigabitEthernet1/0/5.ASW1# show port-security interface GigabitEthernet1/0/5
Port Security : Enabled
Port Status : Secure-up
Violation Mode : Restrict
Aging Time : 0 mins
Aging Type : Absolute
SecureStatic Address Aging : Disabled
Maximum MAC Addresses : 2
Total MAC Addresses : 2
Configured MAC Addresses : 0
Sticky MAC Addresses : 2
Last Source Address:Vlan : 0050.5689.0bad:10
Security Violation Count : 3Recovering from shutdown
shutdown then no shutdown on the port, or automatic recovery with
errdisable recovery cause psecure-violation (default interval 300 seconds).
They will ask next
Why does a laptop sometimes trigger a violation when moved to another port?
A MAC that is secured on one port and then shows up on another secure port in the same VLAN is a violation. Clear the old entry, or use aging so dynamically learned entries expire.
Sticky versus static secure MACs?
Static ones you type by hand. Sticky ones are learned automatically and written into the running config as if typed. Both survive a reload only if the config is saved.
Traps
- Mixing up protect and restrict. Restrict logs and counts, protect is silent.
- Setting a maximum of 1 on a port with an IP phone and a PC behind it.