What is the default port-security violation mode?

Shutdown is the default violation mode on Cisco IOS switches. A violation places the interface into an error-disabled state and blocks traffic until the problem is corrected and the port is recovered.

What is the difference between protect and restrict mode?

Both modes drop frames from unauthorised source MAC addresses while keeping the port operational. Restrict mode increments the violation counter and can generate alerts, while protect mode silently drops the frames.

What does sticky MAC address learning do?

Sticky learning dynamically learns secure MAC addresses and adds them to the running configuration. Use `copy running-config startup-config` after verifying the addresses if they must remain after a switch reload.

How do I recover a port after a security violation?

First identify and correct the cause of the violation. Then enter the interface configuration and issue `shutdown` followed by `no shutdown`, or use errdisable recovery if automatic recovery is part of the approved design.

Can port security stop MAC address spoofing?

Port security can limit accepted MAC addresses, but it does not provide strong identity verification because MAC addresses can be spoofed. For stronger access control, combine it with features such as 802.1X, DHCP snooping and network segmentation.

Switch Port Security Configuration and Modes

Q: What is switch port security?

Switch port security is a Cisco Layer 2 feature that limits which source MAC addresses can use a switch interface. It can learn addresses dynamically, store them as sticky entries or use manually configured secure addresses.

Switch port security is a Layer 2 security feature used to control which source MAC addresses can send traffic through a Cisco switch port. It is commonly applied to user-facing access ports, such as ports connected to PCs, printers, IP phones and kiosks.

The feature is important for CCNA learners because it combines switching concepts, MAC address learning, interface configuration and practical troubleshooting. These skills are covered through guided labs in our CCNA course.

What is switch port security?

Switch port security limits the number of secure MAC addresses allowed on a switch interface. It can dynamically learn addresses, convert learned addresses into sticky entries, or permit only manually configured MAC addresses.

Consider this diagram in words:

PC-A ---- Gi0/1 [Access VLAN 10] ---- Cisco Switch ---- Network
          Allowed MAC: 0050.56aa.1111
          Maximum addresses: 1

When PC-A sends a frame, the switch checks the source MAC address. If the address is permitted, the switch forwards the frame and learns it as a secure MAC address.

If another device is connected to Gi0/1 and uses a different source MAC address after the maximum has been reached, a port-security violation occurs. The switch response depends on whether the interface uses protect, restrict or shutdown mode.

Port security does not inspect IP addresses, usernames or applications. Its decision is based primarily on source MAC addresses received on the protected interface.

What causes a port-security violation?

A violation normally occurs when the interface has reached its maximum number of secure MAC addresses and receives a frame from an additional source address. A violation can also occur when a secure MAC address configured on one secure port appears on another secure port in the same VLAN.

Common causes include:

A user replaces an authorised PC with another device.
Someone connects an unmanaged switch and adds multiple endpoints.
A PC behind an IP phone introduces a second MAC address when the maximum is one.
A stale sticky MAC address remains after equipment replacement.
A device moves between switch ports while its secure address is still associated with the old port.
A docking station, hypervisor or specialised endpoint sends frames from several MAC addresses.

A violation is not always evidence of an attack. Incorrect limits, legitimate hardware changes and unexpected endpoint behaviour are frequent operational causes.

How do protect, restrict and shutdown modes differ?

All three violation modes block traffic from an unauthorised source MAC address, but they differ in logging, counter behaviour and interface state. Shutdown is the default mode and places the port into an error-disabled state after a violation.

Violation mode	Unauthorised frames	Port state	Violation counter and alerts	Typical use
Protect	Dropped	Remains up	No violation notification and generally no counter increment	Quietly discard excess MAC addresses
Restrict	Dropped	Remains up	Counter increments; syslog and SNMP notification can be generated	Maintain service while recording violations
Shutdown	Dropped	Error-disabled	Counter increments and messages are generated	Strict control of endpoint changes

Protect mode

Protect mode silently drops frames from source MAC addresses that are not secure after the configured maximum has been reached. Valid devices continue to communicate, but limited visibility can make troubleshooting harder.

Allowed PC traffic       -> forwarded
Additional device traffic -> dropped
Port                       -> remains secure-up

Restrict mode

Restrict mode also drops violating traffic while leaving the port operational. Unlike protect mode, it records the violation and can generate notifications, making it useful where administrators need evidence without disconnecting valid devices.

Shutdown mode

Shutdown mode places the interface into the error-disabled state. No user traffic passes until the underlying issue is corrected and the port is recovered manually or through configured errdisable recovery.

How do you configure switch port security on Cisco IOS?

Configure the interface as a static access port, enable port security, set the maximum address count and choose a violation mode. You can then use dynamic, sticky or manually configured secure MAC addresses.

Basic access-port configuration

This example allows one dynamically learned MAC address on GigabitEthernet0/1. The port enters the error-disabled state if another source address causes a violation.

configure terminal
interface gigabitEthernet 0/1
 description User-PC
 switchport mode access
 switchport access vlan 10
 switchport port-security
 switchport port-security maximum 1
 switchport port-security violation shutdown
 spanning-tree portfast
end

The shutdown violation mode is the default, but configuring it explicitly makes the intended policy clear.

Port security should not be applied blindly to every interface. Confirm platform support and endpoint behaviour before using it on trunks, access points, virtualisation hosts or interfaces expected to carry many source MAC addresses.

Sticky MAC address learning

Sticky learning dynamically learns source MAC addresses and adds them to the running configuration as sticky secure entries.

configure terminal
interface gigabitEthernet 0/1
 switchport port-security mac-address sticky
end

After the expected endpoint sends traffic, verify the learned address and save the configuration:

show port-security address
show running-config interface gigabitEthernet 0/1
copy running-config startup-config

Saving is important because sticky entries stored only in the running configuration can be lost after a reload.

Manually configured secure MAC address

Use a static secure address when a port must accept only a specific, known endpoint:

configure terminal
interface gigabitEthernet 0/1
 switchport port-security
 switchport port-security mac-address 0050.56aa.1111
 switchport port-security maximum 1
 switchport port-security violation shutdown
end

IP phone and PC configuration

A desk port may carry one MAC address from the IP phone and another from the connected PC. The maximum must account for both devices.

configure terminal
interface gigabitEthernet 0/2
 description IP-Phone-and-PC
 switchport mode access
 switchport access vlan 10
 switchport voice vlan 20
 switchport port-security
 switchport port-security maximum 2
 switchport port-security mac-address sticky
 switchport port-security violation restrict
 spanning-tree portfast
end

The correct maximum depends on the actual endpoint design. Observe legitimate MAC address use before enforcing a low limit.

How can you verify switch port security?

Use show port-security interface to check the port state, violation mode, maximum addresses and violation count. Use show port-security address to identify which secure MAC addresses are associated with each interface.

show port-security interface gigabitEthernet 0/1

A typical result may look similar to this:

Port Security              : Enabled
Port Status                : Secure-up
Violation Mode             : Shutdown
Maximum MAC Addresses      : 1
Total MAC Addresses        : 1
Configured MAC Addresses   : 0
Sticky MAC Addresses       : 1
Security Violation Count   : 0

Interpret the important fields as follows:

Secure-up means the port is operational and port security is active.
Secure-shutdown indicates that a security violation has disabled the port.
Maximum MAC Addresses is the configured capacity.
Total MAC Addresses shows the secure addresses currently associated with the port.
Security Violation Count helps confirm violations in restrict or shutdown mode.

Additional verification commands include:

show port-security
show port-security address
show interfaces status err-disabled
show running-config interface gigabitEthernet 0/1
show logging | include PSECURE|ERR_DISABLE

Command output varies slightly between Cisco IOS releases and switch models, but the operational fields are similar.

How do you troubleshoot a port-security violation?

First identify the violating port, its configured limit and the secure MAC addresses already associated with it. Do not immediately re-enable an error-disabled port without checking whether the new device is authorised.

1. Confirm the port state

show interfaces status err-disabled
show port-security interface gigabitEthernet 0/1

A shutdown-mode violation may produce log messages similar to these:

%PORT_SECURITY-2-PSECURE_VIOLATION: Security violation occurred
%PM-4-ERR_DISABLE: psecure-violation error detected on Gi0/1

2. Inspect secure addresses and configuration

show port-security address
show running-config interface gigabitEthernet 0/1
show mac address-table interface gigabitEthernet 0/1

Compare the learned or configured addresses with the authorised device MAC addresses. Check whether an IP phone, docking station or downstream switch explains the additional source.

3. Correct the cause

The correct action may be to disconnect an unauthorised device, increase the maximum for a valid design, or replace a stale sticky entry. To remove a specific old sticky address, use the corresponding configuration command with no:

configure terminal
interface gigabitEthernet 0/1
 no switchport port-security mac-address sticky 0050.56aa.1111
end

Allow the authorised endpoint to send traffic so that a new sticky address can be learned, and then save the configuration.

4. Recover an error-disabled port

After correcting the cause, manually reset the interface:

configure terminal
interface gigabitEthernet 0/1
 shutdown
 no shutdown
end

Automatic recovery can be configured, but it should not hide repeated violations:

configure terminal
errdisable recovery cause psecure-violation
errdisable recovery interval 300
end

If the unauthorised source remains connected, another violation may occur after recovery.

Symptom	Likely cause	Check
Port is error-disabled	Shutdown-mode violation	Logs and `show port-security interface`
New PC has no connectivity	Old sticky MAC remains	Secure address table and running configuration
Phone works but PC does not	Maximum is too low	Count phone and PC MAC addresses
Violation counter rises but port stays up	Restrict mode is active	Violation mode and connected devices
Traffic disappears without useful alerts	Protect mode is active	Secure address limit and MAC table

Where should switch port security be used?

Switch port security is most useful on stable, user-facing access ports where the expected number of endpoints is known. It is less suitable for interfaces that legitimately receive traffic from many changing source MAC addresses.

Appropriate use cases include:

Office desktop access ports
Printer and point-of-sale ports
Kiosks and fixed-purpose terminals
IP phone and PC desk connections
Unused access ports as part of a broader shutdown and hardening policy

Use caution on wireless access point uplinks, virtualisation hosts, trunk links and ports connected to unmanaged switches. A maximum of one or two addresses can interrupt legitimate traffic on these interfaces.

MAC addresses can also be spoofed, so port security is not complete identity-based access control. Stronger designs may combine it with 802.1X, DHCP snooping, Dynamic ARP Inspection, VLAN segmentation and properly designed ACLs. For traffic-filtering examples, read our guide to Cisco ACL configuration.

How does port security compare with other controls?

Port security controls source MAC addresses on an individual switch interface, while other security features solve different problems. It should be treated as one layer in an access-switch security design rather than a replacement for authentication or traffic filtering.

Control	Main decision factor	Main purpose
Port security	Source MAC address and address count	Limit devices on a switch port
802.1X	User or device credentials	Authenticate before granting network access
ACL	IP addresses, protocols and ports	Permit or deny selected traffic
DHCP snooping	Trusted DHCP messages and bindings	Block rogue DHCP behaviour
Dynamic ARP Inspection	ARP data validated against bindings	Reduce ARP spoofing attacks

Learners preparing for defensive networking roles can explore how these controls work together in a Cybersecurity and SOC course.

How can you practise switch port security in a lab?

Create a small topology with one Cisco switch and two PCs, then connect each PC to the same protected port at different times. Generate traffic after every connection because the switch must receive a frame before it can learn or evaluate the source MAC address.

Configure Gi0/1 with a maximum of one secure address and restrict mode.
Connect PC-A and send a ping to generate frames.
Verify that PC-A appears in show port-security address.
Disconnect PC-A and connect PC-B without removing the secure entry.
Generate traffic from PC-B and check the violation counter.
Repeat the test with protect and shutdown modes.
In shutdown mode, confirm the error-disabled state and practise recovery.

Record the port state, counter and log behaviour for each test. This makes the differences between the three violation modes easier to remember than command memorisation alone.

What are the key switch port security best practices?

Set limits based on real endpoint behaviour, use descriptive interface configurations and verify sticky addresses before saving them. Monitor violations and investigate their cause instead of repeatedly recovering ports without diagnosis.

Configure user ports explicitly as access ports.
Use sticky learning only after confirming the connected endpoint.
Allow enough addresses for valid phones, PCs or docking stations.
Save approved sticky entries to the startup configuration.
Document exceptions for ports that require multiple MAC addresses.
Combine port security with authentication, segmentation and switch hardening.

What should you remember?

Switch port security limits source MAC addresses on Cisco switch interfaces. Protect silently drops violating traffic, restrict drops and records it while keeping the port up, and shutdown places the port into an error-disabled state.

Reliable implementation requires correct limits, verification commands and a clear recovery process. Practise configuring and troubleshooting these behaviours in a lab before applying them to production access ports.

Reviewed by Network Rhinos networking trainers.

To practise switching, VLANs, port security and troubleshooting in structured labs, view our CCNA course batch and enquiry details.

Switch Port Security: Configuration and Violation Modes