portsecurity

Port security is a network security feature used on Ethernet switches to restrict the use of switch ports to a limited set of devices by binding one or more MAC addresses to a port. It helps prevent unauthorized devices from accessing the network through that port and protects against MAC address table poisoning and some forms of MAC flooding.

Implementation typically includes: dynamic MAC learning, where the switch learns source MAC addresses on a per-port basis; sticky MAC addresses, where learned addresses are saved to the running or startup configuration; static MAC entries; and a maximum number of MAC addresses per port to prevent address table exhaustion. When a violation occurs, the switch can take one of several actions: shutdown the port (err-disabled), drop packets from unauthorized addresses (restrict), or drop unauthorized frames while still allowing authorized ones (protect). Aging can be configured to remove dynamically learned addresses after a period of inactivity.

Port security commonly complements other access-control methods such as IEEE 802.1X, DHCP snooping, and dynamic ARP inspection. It is most effective on access ports connected to end devices; on trunk ports or environments with legitimate multi-device connections, it requires careful planning.

Limitations include potential administrator lockouts if misconfigured, inability to prevent spoofing of allowed addresses, and dependence on switch vendor implementation differences. It should be used as part of a layered security strategy.

See also: 802.1X, MAC address authentication, network access control, VLAN security.