CCNA Recap: Port Security

Trunk ports and Etherchannel ports are not eligible for Port Security.
Why?

Etherchannel ports are bundled logically to look like one link with larger capacity than a single link.

Trunk ports carry all traffic.

switchport mode access
switchport port-security

Port security

• does not care where frames come from (local device or other switches)
• Watch incoming frames, keeps list of source MACs & counter of source macs

Sticky Secure Mac Addresses

• Port security learns mac of each port and stores them so you don’t have to put in everyone by hand.

Because it's a switch  - Layer 2 - It's all about MAC Addresses.

show port-security [interface] #

Secure Shutdown

• interface has been disabled because of port-security detecting a MAC address it doesn't recognize.

Protect

• discards traffic

Restrict

• Discards Traffic
• Sends log / SNMP messages (161/162)

Err-Disabled Shutdown

• discards traffic
• Sends log / snmp messages
• +1 violation counter per frame
• disables interface and discards all traffic
• default setting

Sticky

• When someone plugs into the port, the switch remembers it. If someone else tries to, the port doesn't work.

Further Reading;

Switchport Port Security Explained

---

EMPLOYERS: This is me putting new skills into practice.