Cisco Catalyst Port Security: Sticky MAC and Violation Modes

Port security is the first line of defense against unauthorized devices plugging into your switch ports: it limits input to a defined set of MAC addresses and takes a configurable action when an unknown device appears. Based on Cisco's official Catalyst security configuration guides, this article explains the three types of secure MAC addresses (static, dynamic, sticky), the four violation modes with their exact behaviors, and gives copy-paste configurations for enabling port security, sticky learning and aging on Catalyst switches. The second half is a hands-on walk-through: a complete three-port configuration, a decode of every field in the show port-security outputs, and a symptom-to-cause troubleshooting table you can use at the console.

How Port Security Works

A secure port only forwards packets whose source MAC address is in the defined group. Once the maximum number of secure addresses is reached, any packet from a new source triggers a security violation. Port security can only be configured on static access or trunk ports — not on dynamic access ports.

Types of Secure MAC Addresses

• Static secure MAC — manually configured with switchport port-security mac-address, stored in the address table and in the running config.
• Dynamic secure MAC — learned automatically, stored only in the address table, removed on reboot.
• Sticky secure MAC — dynamically learned then converted to sticky, added to the running config so the interface does not need to relearn them after restart.

Violation Modes

Default configuration: port security disabled, maximum 1 secure MAC per port, violation mode shutdown, aging disabled.

Step-by-Step: Enabling Sticky Port Security on a Catalyst Access Port

Configure port security in a fixed order, because several commands are rejected while the port is still in a dynamic mode.

1. Enter the interface and force a static port mode. Port security is refused on dynamic-access ports, so the first command is always the mode change: interface gigabitethernet1/0/1 then switchport mode access (or switchport mode trunk for a trunk).
2. Enable port security on the interface. switchport port-security switches the interface to secure mode. Doing this alone leaves you with the default maximum of 1 and the default violation of shutdown — a trap for the unwary.
3. Set a realistic maximum. switchport port-security maximum 2 for a PC plus IP phone, higher for a port that legitimately sees several MACs. Count the addresses actually seen on the port, then add one spare.
4. Choose the violation mode. switchport port-security violation restrict keeps the port up and logs; shutdown makes the port err-disable, which is louder but disconnects everyone.
5. Enable sticky learning. switchport port-security mac-address sticky makes the switch write every learned address into the running configuration automatically, so the port never has to relearn after a reload.
6. Save the configuration. Sticky entries live in the running config only until you copy running-config startup-config. Reload without saving and every sticky address is lost.

Configuration Example

configure terminal
interface gigabitethernet1/0/1
switchport mode access
switchport port-security
switchport port-security maximum 20
switchport port-security violation restrict
switchport port-security mac-address sticky
end
show port-security interface gigabitethernet1/0/1

With sticky learning enabled, learned MACs are written into the running configuration. On ports with a voice VLAN (Cisco IP phone), set the maximum to 2 — one for the phone (learned on the voice VLAN) and one for the attached PC.

A Complete Worked Example: PC Plus Cisco IP Phone

The classic access port carries a phone and a workstation daisy-chained behind it. The port needs two secure addresses, one of them on the voice VLAN, and a violation action that does not take the phone down when a guest plugs a laptop into the PC port:

interface GigabitEthernet1/0/10
 description User desk 2 - phone + PC
 switchport mode access
 switchport access vlan 110
 switchport voice vlan 210
 switchport port-security maximum 2
 switchport port-security mac-address sticky
 switchport port-security violation restrict
 switchport port-security aging time 120
 switchport port-security aging type inactivity
 spanning-tree portfast

Once the phone and PC boot, both addresses appear as SecureSticky, one tagged VLAN 210 and one tagged VLAN 110. If someone unplugs the PC and attaches an unauthorized device, that frame is dropped and the violation counter increments — the phone keeps working because the port never went down. That is exactly the trade-off that makes restrict the right default for user-facing ports.

Aging Secure Addresses

switchport port-security aging time 120
switchport port-security aging type inactivity

absolute ages all addresses out after the timer regardless of traffic; inactivity only ages addresses that have been idle for the timeout period.

Verifying Port Security: Decoding the show Output

The summary command answers "which ports are secured and how noisy have they been". Read it left to right — the last column tells you the mode, the second-to-last the number of drops that never reached a log server:

Switch# show port-security
Secure Port  MaxSecureAddr  CurrentAddr  SecurityViolation  Security Action
                (Count)       (Count)          (Count)
----------------------------------------------------------------------------
      Gi1/0/10             2            2                  0         Restrict
      Gi1/0/11             1            1                  7         Restrict
      Gi1/0/12             1            0                  0         Shutdown

Gi1/0/11 with a violation count of 7 and a maximum of 1 is the signature of a port that keeps seeing a second MAC — typically a small unmanaged switch or a device with several interfaces on one cable. Now drill into a single interface:

Switch# show port-security interface GigabitEthernet1/0/10
Port Security              : Enabled
Port Status                : Secure-up
Violation Mode             : Restrict
Aging Time                 : 120 mins
Aging Type                 : Inactivity
SecureStatic Address Aging : Disabled
Maximum MAC Addresses      : 2
Total MAC Addresses        : 2
Configured MAC Addresses   : 0
Sticky MAC Addresses       : 2
Last Source Address:Vlan   : 0011.2233.4455:110
Security Violation Count   : 0

• Port Status — Secure-up is healthy; Secure-shutdown means the port was error-disabled by a violation.
• Maximum / Total MAC Addresses — the budget and what is currently held. Total equal to Maximum means the port is at capacity and the next new MAC will violate.
• Configured vs Sticky MAC Addresses — how many were typed in by hand versus learned dynamically. A port showing all sticky addresses is being managed the easy way.
• Last Source Address:Vlan — the last source MAC and VLAN the port saw; on a violating port this is the device that tripped it.
• Security Violation Count — cumulative drops since the last clear. A non-zero value on a restrict port is a real incident to investigate, not noise.

Decoding the Secure MAC Address Table

Switch# show port-security address
          Secure Mac Address Table
-------------------------------------------------------------------
Vlan    Mac Address       Type            Ports   Remaining Age
                                                        (mins)
----    -----------       ----            -----   -------------
110     0011.2233.4455    SecureSticky    Gi1/0/10      -
210     0011.2233.4466    SecureSticky    Gi1/0/10      -
110     00aa.bbcc.0001    SecureDynamic   Gi1/0/11       -

SecureSticky entries are the ones that survive a reload; SecureDynamic entries disappear at reboot; SecureConfigured entries are the hand-typed static addresses. The Remaining Age column only carries a value when aging is enabled and the entry is counting down.

Troubleshooting Common Port Security Problems

Clearing Secure Addresses Without a Reboot

When a device is replaced, the old MAC address sits in the secure table and blocks the new one. You do not need to bounce the port; clear the specific category and let sticky learning repopulate it:

Switch# clear port-security dynamic interface GigabitEthernet1/0/10
Switch# clear port-security sticky interface GigabitEthernet1/0/10
Switch# clear port-security configured interface GigabitEthernet1/0/10

Use dynamic to drop only the auto-learned entries, sticky to drop the ones written into the running config by sticky learning, and configured to remove addresses you typed by hand. After clearing, unplug and replug the device (or wait for the next frame) and the new address is learned and written into the running configuration. Remember to save afterwards, or the cleared state returns on the next reload.

Port Security on Trunks and Uplinks

Port security is technically valid on a static trunk, but a trunk feeding a downstream switch or access stack carries every MAC behind it, and a small maximum will be exceeded within seconds. If you must secure a trunk, raise the maximum to the real expected count and use restrict so the link is never taken down by a legitimate new endpoint. In most designs the better answer is to leave the uplink unsecured and enforce port security on the edge ports where devices actually connect — that is where the feature provides value and where mistakes are cheap to fix. Port security is not supported on dynamic-access ports, on ports running the dynamic auto or dynamic desirable modes, or on ports configured as SPAN destinations, so confirm the port role before you start.

Best Practices Checklist

• Set switchport mode access before anything else — port security will not configure otherwise.
• Never leave the maximum at the default of 1 on a port that may see a phone or a hypervisor.
• Use restrict for user ports and shutdown for locked, single-device ports.
• Enable sticky learning so a reload does not force the port to relearn.
• Always copy running-config startup-config after the addresses are learned.
• Forward %PORT_SECURITY-2-PSECURE_VIOLATION syslog to your monitoring platform.
• Consider errdisable recovery cause psecure-violation for ports where an outage is worse than a repeated violation.

Related Security Articles on This Site

See also Catalyst MAC flap and loop troubleshooting, Catalyst STP loop troubleshooting and Cisco IOS password recovery. For a deeper look at what each violation mode does and how err-disable recovery works, read port security violation modes explained.

原文链接：http://www.cisco.com/en/US/docs/switches/lan/catalyst3850/software/release/3.2_0_se/multibook/configuration_guide/b_consolidated_config_guide_3850_chapter_011111.html