Cisco Port Security and Sticky MAC: Violation Modes Explained

Cisco port security locks a switch port to a fixed set of MAC addresses; sticky MAC makes it practical by learning the first device automatically and writing that address into the running configuration. Once the port reaches its maximum, any unrecognized source triggers a violation action. This guide configures sticky port security on an access port, explains the three violation modes, and shows how to recover an err-disabled port.

Static vs Dynamic vs Sticky MAC

• Dynamic — MACs age out of the table on a timer; no security, any device can connect.
• Static — every MAC typed by hand; maximum security, high admin burden.
• Sticky — the switch learns MACs and writes switchport port-security mac-address sticky <mac> into the running config automatically; entries survive a reload only after write memory.

Port Security Configuration with Sticky MAC

Port security only runs on access or voice ports — the port must not be a trunk or left in dynamic auto mode:

Switch(config)# interface GigabitEthernet0/1
Switch(config-if)# switchport mode access
Switch(config-if)# switchport port-security
Switch(config-if)# switchport port-security maximum 2
Switch(config-if)# switchport port-security mac-address sticky
Switch(config-if)# switchport port-security violation shutdown
Switch(config-if)# no shutdown
Switch# write memory

The example allows a PC plus an IP phone. Defaults to know: maximum is 1 and the default violation mode is shutdown — so enabling port security without tuning maximum means a second device immediately err-disables the port. For a voice-VLAN port set maximum 2 and bind addresses per VLAN with switchport port-security mac-address sticky <mac> vlan voice.

Violation Modes: Protect, Restrict, Shutdown

• Protect — silently drops unknown traffic; no log, counter not incremented. Least visible.
• Restrict — drops the traffic, sends syslog/SNMP, increments the violation counter; port stays up.
• Shutdown — err-disables the port (default); the most disruptive but the most obvious.

Verification and Recovery

Switch# show port-security interface GigabitEthernet0/1
Switch# show port-security address
Switch# show running-config interface GigabitEthernet0/1

After a violation the port shows Secure-shutdown and the last offending source address. Bring it back manually or automatically:

Switch(config)# interface GigabitEthernet0/1
Switch(config-if)# shutdown
Switch(config-if)# no shutdown
Switch(config)# errdisable recovery cause psecure-violation
Switch(config)# errdisable recovery interval 300

Port security stops rogue devices at the edge but not ARP spoofing — pair it with DHCP snooping (its trusted/untrusted model complements secure ports) and the loop protections in PortFast, BPDU guard and root guard.

原文链接：https://www.netstuts.com/sticky-mac