Port security (networking)
Also known as: switchport security
Port security is a Layer 2 switch feature that restricts which devices may send traffic on an interface by limiting and learning source MAC addresses. When a violation occurs, the switch can shut down the port, drop the traffic, or log the event.
Port security controls access at the switch port itself. An administrator enables it on an access interface and sets a maximum number of MAC addresses allowed on that port. The switch records the source MAC addresses of incoming frames as secure addresses; once the limit is reached, any frame from a different source MAC is treated as a violation. This blocks unauthorized devices, prevents someone from plugging a rogue switch or hub into a wall jack, and mitigates MAC flooding attacks that try to overwhelm the switch's address table.
Secure MAC addresses can be defined three ways. Static addresses are configured manually and stored in the running configuration. Dynamic addresses are learned automatically and lost when the switch reloads. Sticky addresses are learned dynamically but written into the running configuration, so they survive a reload once the configuration is saved — a common compromise between the manual effort of static entries and the impermanence of dynamic ones.
Three violation modes determine the response. Shutdown is the default: the port moves to an err-disabled state and stops forwarding entirely until an administrator re-enables it or error recovery times out. Restrict drops the offending frames, increments the violation counter, and sends an SNMP trap and syslog message while the port keeps working for authorized devices. Protect silently drops the offending frames with no notification and no counter increment. Port security applies only to access and trunk ports that are statically configured — it cannot be enabled on a port left in dynamic negotiation mode.
Port security is explicitly listed in the security fundamentals domain of the CCNA exam. Be ready to configure it, choose the appropriate violation mode for a scenario, explain the difference between sticky and dynamic learning, and recognize err-disabled as the symptom of a shutdown-mode violation along with the steps to recover the port.
Key takeaways
- Port security limits which MAC addresses may send traffic on a switch interface.
- Secure addresses can be static, dynamically learned, or sticky-learned and saved to the configuration.
- Violation modes are shutdown (default, err-disable), restrict (drop and notify), and protect (drop silently).
- It defends against rogue devices and MAC flooding attacks at Layer 2.
- The port must be statically configured as access or trunk — dynamic negotiation ports are not supported.