How to Set Up Port Security on Cisco Switches: MAC Address Limiting and Violation Actions

Port security was one of the first switch security features I ever configured, and it’s still one of the features I recommend to almost every team hardening an access layer, because it addresses a very simple but very real risk: unauthorized devices plugging into open network jacks. In this guide I’ll cover exactly how port security works, how to configure it for different real-world needs, and the mistakes that turn a good security control into a support headache.

Why Port Security Matters

Think about how many physical Ethernet jacks exist in a typical office — conference rooms, empty desks, under-desk cabling that’s easy to reach. Without any control at Layer 2, anyone who can physically access one of those jacks can plug in a laptop, a rogue access point, or a small switch to attach multiple unauthorized devices, and gain a foothold on your network. Port security addresses this by limiting which — and how many — MAC addresses are allowed to communicate through a given switchport, and defining exactly what happens when that limit is violated.

Networking Fundamentals Behind Port Security

Port security operates by inspecting the source MAC address of frames entering an interface and comparing it against a list of allowed addresses for that port. Key concepts:

• Maximum MAC addresses: The number of unique source MACs allowed to be “learned” or associated with the port at once.
• Secure MAC address types:
  • Static: Manually configured MAC addresses.
  • Dynamic: Learned automatically from traffic, but lost on a switch reload.
  • Sticky: Learned dynamically but then converted into the running configuration automatically, surviving a reload once saved.
• Violation actions: What the switch does when a frame arrives from a MAC address beyond the configured maximum, or from a non-allowed address:
  • Protect: Silently drops offending traffic, no logging, no shutdown.
  • Restrict: Drops offending traffic, increments a violation counter, and generates a log/SNMP notification.
  • Shutdown (default): Puts the entire port into an err-disabled state, requiring manual or automatic recovery.

Step 1: Basic Port Security with Sticky MAC Learning

This is the most common real-world configuration for standard end-user access ports.

Switch(config)# interface GigabitEthernet0/5
Switch(config-if)# switchport mode access
Switch(config-if)# switchport access vlan 10
Switch(config-if)# switchport port-security
Switch(config-if)# switchport port-security maximum 2
Switch(config-if)# switchport port-security mac-address sticky
Switch(config-if)# switchport port-security violation restrict
Switch(config-if)# exit

Note that port security requires the port to be explicitly configured as switchport mode access (or trunk, in less common designs) — it will reject configuration on a port still in dynamic negotiation mode. maximum 2 allows for common scenarios like a PC plus a VoIP phone sharing the same port through the phone’s built-in switch.

Step 2: Statically Defining Allowed MAC Addresses

For higher-security ports — server room connections, network device management ports — you may want to hard-code exactly which MAC addresses are permitted, with no learning at all.

Switch(config)# interface GigabitEthernet0/10
Switch(config-if)# switchport mode access
Switch(config-if)# switchport access vlan 20
Switch(config-if)# switchport port-security
Switch(config-if)# switchport port-security maximum 1
Switch(config-if)# switchport port-security mac-address 0011.2233.4455
Switch(config-if)# switchport port-security violation shutdown
Switch(config-if)# exit

Step 3: Configuring Aging for Dynamic/Sticky Entries

By default, secure MAC addresses don’t age out, which can be a problem in environments with frequent device turnover (hot-desking, shared workstations).

Switch(config)# interface GigabitEthernet0/5
Switch(config-if)# switchport port-security aging time 60
Switch(config-if)# switchport port-security aging type inactivity
Switch(config-if)# exit

aging type inactivity ages out an address only after it’s been inactive for the specified time (in minutes), rather than a flat absolute timer — generally the more sensible choice for user-facing ports.

Step 4: Understanding and Choosing the Right Violation Action

For most standard office access ports, I lean toward restrict rather than the default shutdown, because a single momentary violation (someone plugging in an unauthorized second device briefly) won’t take down connectivity for the legitimate device sharing that port, while still being logged for review. For genuinely sensitive ports — server rooms, network infrastructure — shutdown is often the right call, since you want a hard stop and clear incident visibility rather than quietly dropping and continuing.

Switch(config-if)# switchport port-security violation protect

is rarely the right choice in enterprise environments, since it gives you zero visibility that a violation even occurred — I’d reserve it for very specific edge cases only.

Step 5: Verifying Port Security Configuration

Switch# show port-security interface GigabitEthernet0/5

Expected output:

Port Security              : Enabled
Port Status                : Secure-up
Violation Mode             : Restrict
Aging Time                 : 60 mins
Aging Type                 : Inactivity
SecureStatic Address Aging : Disabled
Maximum MAC Addresses      : 2
Total MAC Addresses        : 1
Configured MAC Addresses   : 0
Sticky MAC Addresses       : 1
Last Source Address:Vlan   : 0011.2233.aabb:10
Security Violation Count   : 0

Check all secured MAC addresses switch-wide:

Switch# show port-security address

Secure Mac Address Table
-------------------------------------------------------------------
Vlan    Mac Address       Type                          Ports   Remaining Age (mins)
----    -----------       ----                          -----   -------------------
  10    0011.2233.aabb    SecureSticky                  Gi0/5        58
  20    0011.2233.4455    SecureConfigured              Gi0/10        -

If a port has been err-disabled due to a violation:

Switch# show interfaces GigabitEthernet0/5 status

Port      Name               Status       Vlan       Duplex  Speed Type
Gi0/5                        err-disabled 10         a-full  a-100 10/100/1000BaseTX

And confirm the specific violation with:

Switch# show port-security interface GigabitEthernet0/5

Look at the Security Violation Count and Last Source Address fields to identify the offending MAC.

Step 6: Configuring Automatic Err-Disable Recovery

Rather than requiring a manual shutdown / no shutdown every time a port trips into err-disabled state from a security violation, configure automatic recovery:

Switch(config)# errdisable recovery cause psecure-violation
Switch(config)# errdisable recovery interval 300

This automatically re-enables the port five minutes after a violation-triggered shutdown, while still preserving the log entry for review — a good middle ground between security enforcement and operational convenience.

Practical Lab: Simulating a Port Security Violation

1. Configure GigabitEthernet0/5 with switchport port-security maximum 1, mac-address sticky, and violation shutdown.
2. Connect Host A and let it establish connectivity; confirm with show port-security address that its MAC has been learned and stored as sticky.
3. Disconnect Host A and connect Host B (a different device) to the same port.
4. Observe the port transition to err-disabled and confirm via show interfaces status and the corresponding syslog message (%PM-4-ERR_DISABLE: psecure-violation error detected).
5. Change the violation action to restrict, repeat the test, and observe that instead of shutting down, the port simply drops Host B’s traffic while logging a violation, and Host A (if reconnected) continues working normally.

This lab is a great way to internalize the practical behavioral difference between violation modes rather than just memorizing the definitions.

Real-World Enterprise Scenario

A university IT department dealing with constant dorm-room device turnover (students plugging in laptops, gaming consoles, and occasionally unauthorized personal routers/switches) rolled out port security across all dormitory access ports with maximum 2 (allowing a laptop plus one additional device like a gaming console), sticky learning, violation restrict, and a 4-hour inactivity aging timer to accommodate normal device turnover between semesters without requiring manual re-provisioning. Combined with 802.1X in a later phase, this dramatically reduced unauthorized personal switch/router usage that had previously caused DHCP exhaustion and occasional broadcast storm incidents on shared dorm VLANs.

Security Best Practices

• Use sticky learning for general-purpose access ports; reserve fully static MAC configuration for a small number of genuinely high-security ports.
• Choose restrict for most user-facing ports to balance visibility with availability; reserve shutdown for sensitive infrastructure ports where a hard stop is preferred over continued (even if restricted) operation.
• Always pair port security with a sensible errdisable recovery policy so legitimate violations (like a user innocently swapping their own device) don’t require a help desk ticket every time.
• Combine port security with 802.1X where feasible for identity-based access control — port security alone verifies “a known MAC,” not “an authorized user,” and MAC addresses can be spoofed.
• Regularly audit show port-security address output against your asset inventory to catch stale or unexpected entries.
• Disable unused switchports entirely (shutdown) rather than relying on port security alone to protect ports nobody should be using at all.

Optimization and Performance Tuning

• Set maximum values thoughtfully based on real-world port usage patterns — too restrictive causes support tickets when legitimate multi-device scenarios (PC + phone, PC + docking station) are blocked; too permissive weakens the control’s value.
• Use aging type inactivity with a reasonable timer in high-turnover environments to avoid needing manual clear port-security interventions.
• For very large switch deployments, consider standardizing port security templates via your configuration management/automation tooling rather than configuring interfaces one at a time, to ensure consistency and simplify audits.
• Monitor show port-security violation counts in aggregate over time via SNMP or syslog aggregation to spot patterns — a sudden spike in violations across many ports simultaneously can indicate a broader incident, not just isolated user behavior.

Troubleshooting and Common Mistakes

• Configuring port security on a port still in trunk/dynamic negotiation mode: Port security requires explicit switchport mode access (or trunk, for trunk-based designs); leaving a port in default dynamic auto/desirable mode will prevent proper configuration.
• Setting maximum 1 on ports with VoIP phones: A phone with a pass-through switch to a PC needs at least maximum 2, or the PC will be treated as a violation the moment it’s connected.
• Forgetting errdisable recovery: Leads to unnecessary manual intervention (and delayed user connectivity) every time a legitimate, minor violation occurs.
• Not saving sticky MAC addresses to the running/startup config: Sticky addresses are added to the running configuration automatically, but you still need copy running-config startup-config (or your equivalent config save process) to persist them across a reload.
• Assuming port security stops MAC spoofing entirely: A sufficiently capable attacker can spoof an allowed MAC address; port security is a solid baseline control, not a complete substitute for 802.1X-based identity verification.

Frequently Asked Questions

What’s the difference between sticky and dynamic secure MAC addresses? Dynamic addresses are learned automatically but lost on reload; sticky addresses are also learned automatically but get written into the running configuration, surviving a reload if the config is saved.

What happens by default if I enable port security without specifying maximum or violation settings? The default maximum is 1 MAC address, and the default violation action is shutdown — meaning any second device on that port will err-disable it immediately.

Can port security be used on trunk ports? Yes, though it’s far less common than on access ports, and requires careful planning since a trunk can legitimately carry traffic from many MAC addresses across multiple VLANs.

Does port security protect against VLAN hopping or other Layer 2 attacks? No — port security specifically addresses unauthorized MAC addresses/device counts on a port. VLAN hopping, DHCP spoofing, and ARP spoofing require their own dedicated controls (trunk hardening, DHCP snooping, Dynamic ARP Inspection respectively).

Summary

Port security is a small, easy-to-configure feature that closes a very real physical-access gap in enterprise networks: unauthorized devices plugging into unmonitored jacks. The real design decisions come down to choosing sensible maximum values for realistic multi-device scenarios, picking a violation action that matches the sensitivity of each port, and pairing it with errdisable recovery so operational friction doesn’t outweigh the security benefit. Layer it alongside DHCP snooping, Dynamic ARP Inspection, and ideally 802.1X, and you’ve covered the most common and impactful access-layer security gaps with commodity Cisco IOS features.

References

• Cisco Catalyst Switch Software Configuration Guide — Port Security chapter, cisco.com/c/en/us/support/switches
• Cisco Command Reference — switchport port-security, errdisable recovery
• Cisco documentation on Layer 2 security best practices (port security, DHCP snooping, DAI, 802.1X)