Security on Switchports

network489 · ‎06-02-2008

Can someone please explain to me the difference between the commands, "switchport port-security" (which is the only mandatory command needed to configure port security); and also the "switchport port-security mac-address sticky" command. Doesn't the the first command use the first MAC it sees just like Sticky.

Jon Marshall · ‎06-02-2008

The sticky option in the command tells the switch to add the mac-addresses learnt on the interface to the running config. If you then save that running config and the switch is reloaded it will use those mac-addresses when it has rebooted. See this link for more details:

http://www.cisco.com/en/US/docs/switches/lan/catalyst3750/software/release/12.2_25_sea/configuration/guide/swtrafc.html#wp1038501

Jon

Amit Singh · ‎06-02-2008

Hi Jon, How are you !!

Just to ad to Jon's post,by default this sticky option writes all the dynamically learned addresses to the running-config and you can also define the statically configured mac-addresses with the sticky option to be added to running-config.

HTH,

-amit singh

Jon Marshall · ‎06-02-2008

Amit

Haven't seen you around for a while or maybe i just keep missing you. I'm good, taking a bit of time off work but still keeping my hand in with NetPro when i get the chance :-)

Hope things are good with you

Jon

Amit Singh · ‎06-02-2008

Jon,

I was busy with my CCIE studies.Just a little busy with my stuff. Hardly getting time to catch Netpro these days.

Write me at amisin@gmail.com

-amit singh

Pravin Phadte · ‎06-02-2008

The first one switchport port-security is straight forward, you know the mac-address on that port and you configure it so.

The second one switchport port-security mac-address sticky gives you more flexibility. The mac-address can be dynamically learned. The actual command you type in is:

"switchport port-security mac-address sticky"

The switch then automatically add the command:

"switchport port-security mac-address sticky H.H.H" once it learned the mac-addresss.

You can also manually configured it but you might as well configure as in the first one.

network489 · ‎06-02-2008

I was told that by simply entering the swichport port-security command, we accept the default settings of only allowing one MAC address, and determining that MAC address from the first device that communicates on that specific port. Which seems to be the same idea behind "Sticky".

Jon Marshall · ‎06-02-2008

You are correct in that only one mac-address is allowed but if you then disconnected the device on that port and connected another device then you still only have one mac-address on that port and so it would be allowed.

With sticky you are specifying the actual mac-address that is allowed on that port so if you connect a different device it will not be allowed.

Jon