2

If I have a educational lab that's commonly used for multiple computers for teaching networking. I'm worried that if they remove the computer to put it in the classroom networking gear and come back but plug it in the wrong port that it would restrict their traffic. My basic port config for the student labs is as follows. If they were to unplug a PC from 5/0/7 and into 5/0/8 would that be restricted still?

interface FastEthernet5/0/7
 switchport access vlan 214
 switchport mode access
 switchport port-security
 switchport port-security violation restrict
 spanning-tree portfast
exit

interface FastEthernet5/0/8
 switchport access vlan 214
 switchport mode access
 switchport port-security
 switchport port-security violation restrict
 spanning-tree portfast
exit
  • As I understand it, the switch drops all state for that port when the link state drops (i.e. the cable is unplugged.) Thus, it will not remember what was on that port previously. – Ricky Beam Jan 21 '15 at 2:27
  • @RickyBeam Unless you use the sticky option. – cpt_fink Jan 21 '15 at 4:30
  • Seems there's a bit of disagreement on this. I might have to just ....try it..... SHUDDERS – PsychoData Jan 21 '15 at 13:24
  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer. – Ron Maupin Aug 11 '17 at 2:29
1

No, if I'm reading this right, a violation on the 5/0/8 doesn't "poison" the secure status of the address on 5/0/7. Doing so would allow port-security to be used as an easy DOS tool.

If the secure address was learned on 5/0/7 and they moved to 5/0/8, a violation occurs. If they move back to 5/0/7, their connectivity is restored.

  • Sorry, PsychoData ... I removed the comment you responded to about using inactivity timers. I'd misread the question initially. – Mark Rogaski Jan 20 '15 at 18:26
  • But, yes, I've seen several attempts to avoid MAC move violations with inactivity timers. However, the benefit needs to be weighed against the risk of allowing malicious users from exploiting this. – Mark Rogaski Jan 20 '15 at 18:57
  • I've only ever encountered problems with mac binds triggering port-security when the port-security mac-address sticky command was issued to the interface. If thats the case; any attempt to plug the offending mac into a new port will result in a lockout simply because the switch has the mac bound to another port. – HAL Jan 20 '15 at 20:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.