Limit and learn secure MAC addresses
Port security lets the switch limit the number of source MAC addresses admitted on a port. An address can be configured explicitly or learned as traffic arrives. Cisco’s sticky learning writes learned secure addresses into running configuration, where saving the configuration can preserve them across a restart.
On Cisco switches, protect drops traffic from a violating source. Restrict drops it and also records a violation. Shutdown puts the port in an error-disabled state. A known MAC address is an identifier in the frame, so allowing it does not prove the identity of the user or device sending it.
Try it in a lab
- Configure the first host’s MAC as the one secure address on a supported test port and use restrict mode. Generate traffic from that host and check that it can reach a test peer.
- Replace it with a second host after confirming that the first secure address is still bound. Verify that the second host’s traffic is dropped and the violation counter increases.