Network Skills / CCNA 200-301 Tutorials / Port Security Tutorial

Port Security Tutorial

5 min read

By default, every interface on a Cisco switch is enabled, which means anyone who can physically plug a cable into a wall socket can potentially reach the network through it. Port Security addresses this by letting a switch restrict what is allowed to connect to a given port, based on the MAC address of the connecting device.

With port security configured, an administrator can either bind a port to one or more specific MAC addresses, or simply cap the number of distinct MAC addresses the port will accept. Only devices matching an authorized MAC address are then allowed to send traffic through that port. If an unrecognized device tries to connect, the switch can be told to respond in a particular way — dropping the offending traffic, logging a warning, or shutting the port down entirely.

In the example below, only a host with the MAC address AAAA.AAAA.AAAA (a simplified example — a real MAC address is 48 bits) has been permitted on the port, while traffic from any other MAC address is blocked:

A switch port secured to only one allowed MAC address
Only the configured MAC address is allowed to use this port; other devices are blocked.
// members only

The rest of this article is for members

The full walkthrough, configuration examples and verification steps are available exclusively to paid members.

View membership plans Log in