Port restrictions on core switches

Port restrictions on core switches are implemented using port security, which limits the devices that can connect to a port by controlling MAC addresses and defining violation actions.Overview of Port SecurityPort security is a Layer 2 access control feature that allows administrators to restrict which devices can connect to a switch port by specifying allowed MAC addresses and limiting the number of devices per port . This is particularly useful on access ports connecting endpoints like PCs, printers, or IP phones, rather than trunk ports that carry multiple VLANs . Core switches can also use port security to prevent unauthorized access and mitigate attacks such as MAC flooding .Key FeaturesMAC Address Limiting: You can configure a maximum number of MAC addresses per port. If the number of devices exceeds this limit, a security violation occurs .Static and Dynamic MAC Learning: MAC addresses can be assigned statically (manually) or learned dynamically (sticky), allowing the first connected devices to register up to the configured maximum .Violation Actions: When a violation occurs, the switch can respond in three ways:Shutdown: The port goes into an error-disabled state and stops forwarding traffic (default)Restrict: Unallowed traffic is dropped, logging occurs, and SNMP traps can be sentProtect: Unallowed traffic is dropped without logging Configuration ConsiderationsPort security is not supported on EtherChannel interfaces, private VLAN ports, or 802.1X authenticator interfaces .The maximum number of secure MAC addresses is limited by the switch's system capacity and cannot be set below the number of already configured addresses .On core switches, port security is often applied selectively to access ports at the network edge rather than uplinks or trunk ports to avoid disrupting inter-switch traffic .BenefitsPrevents Unauthorized Access: Only authorized devices can connect to the network .Mitigates MAC Flooding Attacks: Limits the number of learned MAC addresses to prevent CAM table overflow .Improves Network Visibility and Compliance: Administrators can track connected devices and enforce security policies .Best PracticesApply port security primarily on access ports rather than core uplinks.Use sticky MAC addresses for devices that frequently connect to the same port.Choose the appropriate violation mode based on the desired balance between security and network availability.Regularly monitor and audit port security logs to detect unauthorized access attempts. By implementing these port restrictions, core switches can maintain network integrity, prevent unauthorized access, and reduce the risk of Layer 2 attacks while ensuring legitimate traffic flows efficiently.