Switch Port Security

 Switch port security is a network security feature that allows you to control and restrict access to a switch port based on the MAC (Media Access Control) address of the devices connected to it. This feature helps prevent unauthorized devices from connecting to the network and can be particularly useful in securing physical access to network ports. Below are the steps to configure and verify switch port security on a Cisco switch:

Configuration Steps:

1. Access Configuration Mode:

   • Access the switch's command-line interface (CLI) and enter configuration mode.

   bash
   Switch> enable
   Switch# configure terminal
   

2. Enable Port Security on an Interface:

   • Navigate to the interface that you want to configure port security for.

   bash
   Switch(config)# interface interface_type interface_number
   

   • For example, to configure port security on GigabitEthernet 0/1:

   bash
   Switch(config)# interface GigabitEthernet0/1
   

3. Enable Port Security on the Interface:

   • Enable port security on the selected interface.

   bash
   Switch(config-if)# switchport port-security
   

4. Set the Maximum Number of Allowed MAC Addresses:

   • Specify the maximum number of allowed MAC addresses on the interface. The default is usually 1.

   bash
   Switch(config-if)# switchport port-security maximum max_addresses
   

   • For example, to allow up to 2 MAC addresses:

   bash
   Switch(config-if)# switchport port-security maximum 2
   

5. Configure the Port Security Violation Mode:

   • Specify how the switch should react when a violation occurs (e.g., when an unauthorized device is connected). Common violation modes are "shutdown," "restrict," or "protect."

   bash
   Switch(config-if)# switchport port-security violation {shutdown | restrict | protect}
   

   • For example, to shut down the port when a violation occurs:

   bash
   Switch(config-if)# switchport port-security violation shutdown
   

6. Set the Allowed MAC Addresses (Optional):

   • If necessary, you can manually configure the allowed MAC addresses for the port.

   bash
   Switch(config-if)# switchport port-security mac-address mac_address
   

   • This is useful if you want to explicitly allow specific devices to connect to the port.

7. Verify the Port Security Configuration:

   • To verify the port security configuration on the switch, use the following command:

   bash
   Switch# show port-security interface interface_type interface_number
   

   • This command displays information about the configured port security settings on the selected interface.

Verification Steps:

After configuring port security, you can verify its operation to ensure that it is correctly restricting access to the switch port. Here's how to do that:

1. Check Port Security Status:

   • Use the following command to check the port security status and violations on the interface:

   bash
   Switch# show port-security interface interface_type interface_number
   

   • This command provides information about the current status of port security on the interface.

2. Monitor Violation Counts:

   • You can monitor violation counts to see how many times the port security violation action has been triggered:

   bash
   Switch# show port-security
   

   • This command displays information about all interfaces with port security enabled.

Port security helps enhance network security by controlling the devices that can access a switch port. Unauthorized devices are prevented from connecting, and violation actions can be configured to respond to security breaches.