3

If I have a educational lab that's commonly used for multiple computers for teaching networking. I'm worried that if they remove the computer to put it in the classroom networking gear and come back but plug it in the wrong port that it would restrict their traffic. My basic port config for the student labs is as follows. If they were to unplug a PC from 5/0/7 and into 5/0/8 would that be restricted still? 

interface FastEthernet5/0/7
 switchport access vlan 214
 switchport mode access
 switchport port-security
 switchport port-security violation restrict
 spanning-tree portfast
exit

interface FastEthernet5/0/8
 switchport access vlan 214
 switchport mode access
 switchport port-security
 switchport port-security violation restrict
 spanning-tree portfast
exit
Improve this question
4
  • As I understand it, the switch drops all state for that port when the link state drops (i.e. the cable is unplugged.) Thus, it will not remember what was on that port previously.
    – Ricky
    Jan 21, 2015 at 2:27
  • @RickyBeam Unless you use the sticky option.
    – cpt_fink
    Jan 21, 2015 at 4:30
  • Seems there's a bit of disagreement on this. I might have to just ....try it..... SHUDDERS
    – PsychoData
    Jan 21, 2015 at 13:24
  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin ♦
    Aug 11, 2017 at 2:29

1 Answer 1

Reset to default
2

No, if I'm reading this right, a violation on the 5/0/8 doesn't "poison" the secure status of the address on 5/0/7. Doing so would allow port-security to be used as an easy DOS tool.

If the secure address was learned on 5/0/7 and they moved to 5/0/8, a violation occurs. If they move back to 5/0/7, their connectivity is restored.

Improve this answer
3
  • Sorry, PsychoData ... I removed the comment you responded to about using inactivity timers. I'd misread the question initially.
    – Mark Rogaski
    Jan 20, 2015 at 18:26
  • But, yes, I've seen several attempts to avoid MAC move violations with inactivity timers. However, the benefit needs to be weighed against the risk of allowing malicious users from exploiting this.
    – Mark Rogaski
    Jan 20, 2015 at 18:57
  • I've only ever encountered problems with mac binds triggering port-security when the port-security mac-address sticky command was issued to the interface. If thats the case; any attempt to plug the offending mac into a new port will result in a lockout simply because the switch has the mac bound to another port.
    – HAL
    Jan 20, 2015 at 20:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.