Switch Port Access Restrictions

Port security allows you to restrict which devices can connect to a switch port by limiting MAC addresses and defining violation actions. What is Port SecurityPort security is a Layer 2 access control feature on switches that restricts which devices can connect to a specific port. It works by limiting the number of MAC addresses allowed on a port and specifying which MAC addresses are permitted, either statically or dynamically.

This prevents unauthorized devices from accessing the network and mitigates attacks like MAC flooding.

Key Features

Limit MA

C addresses per port: You can set a maximum number of devices that can connect to a port, typically up to 132 on Cisco switches. Allow specific MAC addresses: You can configure MAC addresses statically (manually) or dynamically (sticky learning) to control which devices are allowed. Violation actions: When an unauthorized device attempts to connect, the switch can respond in three ways: Shutdown: The port is disabled and stops forwarding traffic (default behavior).

Restrict: The port remains active, drops unauthorized traffic, and logs the violation. Protect: The port remains active, drops unauthorized traffic, but does not log the violation. Configuration Steps on Cisco SwitchesEnter interface configuration mode for the port you want to secure: CodeCopySwitch# configure terminalSwitch(config)# interface FastEthernet0/1 Set the port to access mode (required for port security): CodeCopySwitch(config-if)# switchport mode access Enable port security: CodeCopySwitch(config-if)# switchport port-security Set the maximum number of allowed MAC addresses: CodeCopySwitch(config-if)# switchport port-security maximum 2 Specify allowed MAC addresses (optional): Static: CodeCopySwitch(config-if)# switchport port-security mac-address 0001.

0203. 0405 Dynamic (sticky): CodeCopySwitch(config-if)# switchport port-security mac-address sticky Define the violation action: CodeCopySwitch(config-if)# switchport port-security violation restrict Use CasesLock a wall jack to a single device to prevent rogue access points or unauthorized switches. Secure printers, cameras, or IoT devices by pinning their MAC addresses.

Prevent MA

C flooding attacks by limiting the number of learned MAC addresses. Properly implementing port security ensures that only authorized devices can access the network, improves visibility of connected devices, and enforces organizational security policies at the access layer.