Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 

How to configure port security on Cisco Catalyst switches that run Cisco IOS system software

 

Introduction:

Port security is easy to configured and it allows you to secure access to a port based upon a MAC address basis.Port security can also configured locally and has no mechanism for controlling port security in a centralized fashion for distributed switches.Port security is normally configured on ports that connect servers or fixed devices, because the likelihood of the MAC address changing on that port is low. A common example of using basic port security is applying it to a port that is in an area of the physical premises that is publicly accessible. This could include a meeting room or reception area  available for public usage. By restricting the port to accept only the MAC address of the authorized device, you prevent unauthorized access if somebody plugged another device into the port.

 

Configuration Steps:

 

By default, the switchport security feature is disabled on all switchports and must be enabled.

 

1) Your switch interface must be L2 as "port security" is configure on an access interface.You can make your L3 switch port to an access interface by using the "switchport" command.

 

2) Then you need to enable port security by using the "switchport port-security" command. This can also be applied in a range of the interfaces on a switch or individual interfaces.

 

3) This step is optional, but you can specify how many MAC addresses the switch can have on one interface at a time. If this setting is not applied the default of one MAC address is used. The command to configure this is as follows, "switchport port-security maximum N" (where N can be from 1 to 6272) Keep in mind the range the number of maximum MAC address depends on the hardware and Cisco IOS you use.

 

4) This step is also optional, but you can define the action to take when a violation occurs on that interface or interfaces. The default is to shut down the interface or interfaces. The command to configure this is as follows "switch port-security violation { protect | restrict | shutdown }"

 

Protect which discards the traffic but keeps the port up and does not send a SNMP message.

Restrict which discards the traffic and sends a SNMP message but keeps the port up

Shutdown which discards the traffic sends a SNMP message and disables the port. (This is the default behavior is no setting is specified.)

 

5) You can specify the MAC address that is allowed to access the network resources manually by using the command "switchport port-security mac-address value". Use this command multiple times if you want to add more than one MAC address.

 

6) If you don’t want to configure manually every single MAC address of your organization then you can have the switch learn the MAC address dynamically using the "switchport port-security mac-address sticky" command. This command allow switch to learn the first MAC address that comes into on the interface.

Configuration Example:

 

Switch(config)# interface gig0/2

Switch(config-if)# switchport port-security

Switch(config-if)# switchport port-security maximum 1

Switch(config-if)# switchport port-security mac-address 00-d0-ba-11-21-31

Switch(config-if)# switchport port-security violation shutdown

Switch(config-if)#end

 

To Verify the port security status use "show port-security"

Related Information:

Configuring Port Security

Comments

so issuing the following:

interface range fastEthernet 0/1-24

switchport mode access

switchport port-security

switchport port-security maximum 1

switchport port-security mac address sticky

switchport port security violation shutdown

end

copy run start

---

Will this allow 1 static MAC on the whole (24 port) switch (no matter where that MAC is plugged in) or does it allow the first MAC plugged into each port on a per-port basis?

Hi Sir, 

I have a Question for you , One Mac Address is enough for all (0-24) Ports on Switch, For a security. 

75703
Views
20
Helpful
2
Comments