PlantUML DiagramPort Security Violation Flow
A structured lesson workspace with readable content, hands-on examples, and a clean path to completion.
A university residence hall has 500 switch ports in student rooms. Users can plug in anything — a laptop, a router, a gaming console. Someone plugs a small switch in and starts forwarding traffic for their friends. Someone else plugs in a device that sends thousands of MAC addresses. The network admin needs to lock down access ports without crippling legitimate use.
Port security is the answer. It limits how many MAC addresses a port can learn, which MAC addresses are allowed, and what happens when a violation occurs. Configured correctly, it stops MAC flooding, MAC spoofing, and rogue switch insertion — all without needing to know every legitimate MAC in advance.
| Mode | Behavior on violation | Logging | Port state |
|---|---|---|---|
| Shutdown (default) | Port goes to err-disabled | Yes (syslog + SNMP) | Down until manually recovered or auto-recovery |
| Restrict | Frames from violating MACs dropped | Yes (syslog + counter increment) | Up; legitimate MACs keep working |
| Protect | Frames from violating MACs dropped | No | Up; silent drop |
Shutdown is the strictest — the port is disabled entirely and requires manual intervention (or configured auto-recovery). Restrict drops the offending frames but keeps the port up and logs the violation. Protect silently drops violating frames with no log. Most access ports use restrict or shutdown; protect is used when logging would generate too much noise.
! Configure port security on an access portSW1(config)# interface gigabitEthernet0/1SW1(config-if)# switchport mode accessSW1(config-if)# switchport port-securitySW1(config-if)# switchport port-security maximum 2SW1(config-if)# switchport port-security violation restrictSW1(config-if)# switchport port-security mac-address stickySW1(config-if)# switchport port-security aging time 60SW1(config-if)# switchport port-security aging type inactivitySW1(config-if)# exit! Optional: auto-recover err-disabled portsSW1(config)# errdisable recovery cause psecure-violationSW1(config)# errdisable recovery interval 300
This configuration allows two MAC addresses on the port (PC + phone). `sticky` tells the switch to learn the first two MACs it sees and add them permanently to the config — no need to look up the MACs in advance. `aging time 60 inactivity` removes a sticky MAC after 60 minutes of inactivity, freeing the slot for a new device if a user swaps hardware.
Sticky MACs are written to `running-config` as static entries — they persist as long as the config exists. Without aging, a port that has learned two MACs stays locked to those MACs forever. With aging + inactivity, a port gracefully accepts a new device after the old one is idle for the aging period. Choose based on how often users move hardware.
`Secure-up` means port security is enabled and the port is forwarding. Two sticky MACs are learned, matching the maximum. Zero violations — normal state. If `Security Violation Count` starts climbing, someone is either moving hardware or actively trying to bypass the policy.
A data center has servers on access ports. Servers occasionally need to have a second NIC connected (for backup path testing). Servers rarely move, and unauthorized MAC changes are rare but should be investigated. Which violation mode is best?
Select the safest next action.
Port security is one of the few Layer 2 controls that's easy to configure and hard to misconfigure. The main gotcha is forgetting to include the `switchport mode access` line — port security doesn't apply to trunk ports by default. If you see `Port Security: Disabled` even after configuring it, check the port mode.
Finish the lesson once you have worked through the material. This awards ★ 40 XP.
Select each vulnerable line, then classify the finding.
Findings
Review target: 16 lines · 1 expected finding