Per access port: learn/limit MACs, act on violations. Default violation mode is shutdown (err-disable); protect drops silently, restrict drops and logs.

interface Gi1/0/1
 switchport mode access
 switchport port-security
 switchport port-security maximum 2
 switchport port-security mac-address sticky
 switchport port-security violation shutdown
 switchport port-security aging time 10 type inactivity

• Sticky converts learned MACs into config — survives reload if you write memory.
• Stops MAC flooding (CAM overflow → switch behaves like a hub) and rogue devices.
• Recovery: manual shutdown/no shutdown or errdisable recovery cause psecure-violation.

Verify: show port-security interface, show port-security address.