Lessons · Network switches · port security
One address per desk
Port security limits how many MAC addresses a port will accept, and says what to do when a different one appears.
Hone is a place to practise programming. This is one of its lessons, written out in full and free to read without an account.
What it is for
It stops somebody unplugging a phone and plugging in a laptop, or hanging an unmanaged switch off a meeting room port, without anyone noticing.
How to think about it
Decide the maximum honestly: a PC behind a phone is two addresses, not one. Then pick the violation mode you can live with, because shutdown means somebody has to come and re-enable the port.
Worked example
enableThe # prompt.
configure terminalInto configuration mode.
interface gi0/5A desk port. Port security is for access ports only; the switch refuses it on a trunk.
switchport mode accessSo set the mode first.
switchport port-securityOn, with the defaults: one address, and shut the port on a violation.
switchport port-security maximum 2A phone with a PC behind it is two addresses.
switchport port-security violation restrictDrop and count the offending frames rather than disabling the port, so a mistake does not need a site visit.
switchport port-security mac-address stickyLearn the addresses that are there now and write them into the configuration.
endOut.
show running-configFour lines under one interface, and together they are the policy.
Your turn
Allow two addresses on this port.
switchport port-security 2
Console into a switch
The trap
Leaving the violation mode at its default of shutdown on a busy floor. The first person who swaps a laptop kills the port, and it stays dead until somebody logs in.