Cisco Catalyst Port Security: Sticky MAC and Violation Modes

2026年8月31日 LOG admin

Port security is the first line of defense against unauthorized devices plugging into your switch ports: it limits input to a defined set of MAC addresses and takes a configurable action when an unknown device appears. Based on Cisco's official Catalyst security configuration guides, this article explains the three types of secure MAC addresses (static, dynamic, sticky), the four violation modes with their exact behaviors, and gives copy-paste configurations for enabling port security, sticky learning and aging on Catalyst switches.

How Port Security Works

A secure port only forwards packets whose source MAC address is in the defined group. Once the maximum number of secure addresses is reached, any packet from a new source triggers a security violation. Port security can only be configured on static access or trunk ports — not on dynamic access ports.

Types of Secure MAC Addresses

Static secure MAC — manually configured with switchport port-security mac-address, stored in the address table and in the running config.
Dynamic secure MAC — learned automatically, stored only in the address table, removed on reboot.
Sticky secure MAC — dynamically learned then converted to sticky, added to the running config so the interface does not need to relearn them after restart.

Violation Modes

Mode	Traffic forwarded	SNMP trap	Syslog	Shuts port
protect	No	No	No	No
restrict	No	Yes	Yes	No
shutdown	No	Yes	Yes	Yes (error-disable)
shutdown vlan	No	Yes	Yes	VLAN error-disabled

Default configuration: port security disabled, maximum 1 secure MAC per port, violation mode shutdown, aging disabled.

Configuration Example

configure terminal
interface gigabitethernet1/0/1
switchport mode access
switchport port-security
switchport port-security maximum 20
switchport port-security violation restrict
switchport port-security mac-address sticky
end
show port-security interface gigabitethernet1/0/1

With sticky learning enabled, learned MACs are written into the running configuration. On ports with a voice VLAN (Cisco IP phone), set the maximum to 2 — one for the phone (learned on the voice VLAN) and one for the attached PC.

Aging Secure Addresses

switchport port-security aging time 120
switchport port-security aging type inactivity

absolute ages all addresses out after the timer regardless of traffic; inactivity only ages addresses that have been idle for the timeout period.