One of the simplest yet most effective ways to physically breach an organizational network is plugging an unknown laptop into an empty switch port in a conference room or hallway. Port Security is designed exactly to prevent this scenario. Let's walk through configuring it on a Cisco switch.
What exactly does Port Security do?
This feature lets you specify exactly how many, and which, MAC addresses a physical switch port is allowed to accept. If a device with an unauthorized MAC address connects to that port, the switch can — based on your configuration — shut the port down, log a warning, or simply ignore that device's traffic.
Step 1: Enter the target port's configuration
Let's say we want to secure port fastEthernet 0/5:
enable
configure terminal
interface fastEthernet 0/5
Step 2: Set the port to access mode
Port Security only works on access ports (not trunk ports):
switchport mode access
Step 3: Enable Port Security
switchport port-security
Step 4: Set the maximum number of allowed MAC addresses
By default, Port Security only allows one MAC address. You can change this — for example, if a small IP phone switch is also connected to this port:
switchport port-security maximum 2
Step 5: Specify how the allowed address is learned
There are three ways for the switch to learn which MAC address is allowed:
switchport port-security mac-address sticky
Sticky mode is the best choice for most cases: the switch automatically learns the first connected MAC address(es) and saves them into the configuration — you no longer need to manually type in the MAC address yourself.
Step 6: Set the switch's response to a violation (Violation Mode)
switchport port-security violation shutdown
There are three common modes:
shutdown (default and strictest): the port is completely disabled and must be manually re-enabled.
restrict: ignores the unauthorized device's traffic but doesn't disable the port, and logs the event.
protect: similar to restrict but doesn't even log it.
For most organizations, shutdown or restrict are the more sensible choices.
Step 7: Verify the configuration
show port-security interface fastEthernet 0/5
This command shows the full Port Security status on that port — including the allowed address count, learned addresses, and violation mode.
Practical test
If an unknown device (with a MAC address different from what was learned) now connects to this port, depending on the chosen violation mode, the port either shuts down entirely or that device's traffic gets ignored — either way, simple physical intrusion into the network is no longer possible.
Port Security is one of those small but highly effective settings I always check during physical network security assessments — and it's a core part of my CCNA and network security courses.
Blog