Port Security protects switch ports by limiting and controlling which MAC addresses may send traffic on a port – a Layer 2 feature on access ports that stops unauthorized devices.

Facts

Point	Description
OSI layer	Layer 2
Port type	switchport mode access
Main function	Limits MAC addresses per port
Protects against	MAC flooding, rogue devices
Violation modes	protect, restrict, shutdown

What problem does it solve?

Without it an attacker can connect unauthorized devices or run MAC table flooding – the CAM table overflows and the switch behaves like a hub, exposing traffic.

Violation modes (exam critical)

Mode	Effect
protect	Drops frames, no logging
restrict	Drops frames + syslog + counter
shutdown	Port goes err-disabled (default)

MAC learning methods

Method	Description
Static	Manually configured
Dynamic	Learned automatically, not saved
Sticky	Learned + saved into running-config ⭐

Aging removes MAC entries automatically: types absolute and inactivity – reduces admin overhead.

Configuration

interface FastEthernet0/1
 switchport mode access
 switchport port-security
 switchport port-security maximum 1
 switchport port-security violation shutdown   ! or restrict / protect
 switchport port-security mac-address sticky   ! very common
 switchport port-security aging time 10
 switchport port-security aging type inactivity

Verification & troubleshooting

show port-security interface fa0/1
show port-security address
show interface status err-disabled

Recovery from err-disabled:

interface fa0/1
 shutdown
 no shutdown
! or global auto-recovery:
errdisable recovery cause psecure-violation
errdisable recovery interval 300

CCNA: what port security is, violation modes, sticky, basic config. CCNP: err-disabled troubleshooting and combining with DHCP snooping, DAI, IP source guard; design choices (aging, restrict vs shutdown).