1

I have this configuration on an interface of my CISCO switch (switch 1).

 switchport access vlan 52  
 switchport mode access  
 switchport port-security  
 switchport port-security aging time 5  
 switchport port-security violation restrict  
 spanning-tree portfast  

Now when I connect another switch (switch 2) to this interface, then a PC (PC 1) to switch 2, all works fine. But when I connect another PC (PC 2) to switch 2, PC 1 goes automatically out of network, leaving only PC 1.

In summary, only one device can be connected to switch 2.

Here are the logs

Security violation occurred, caused by MAC address a0b3.cc9c.796a on port GigabitEthernet2/26.

2d02h: %PORT_SECURITY-2-PSECURE_VIOLATION: Security violation occurred, caused by MAC address a0b3.cc9c.796a on port GigabitEthernet2/26.
2d02h: %PORT_SECURITY-2-PSECURE_VIOLATION: Security violation occurred, caused by MAC address a0b3.cc9c.796a on port GigabitEthernet2/26.
2d02h: %PORT_SECURITY-2-PSECURE_VIOLATION: Security violation occurred, caused by MAC address a0b3.cc9c.796a on port GigabitEthernet2/26.

What could be the problem? How can I solve the problem?

Thanks in advance

PS: I am new to Networking

  • See the answer by Lukas Nagy. You are specifically telling the port, in the configuration, that you can only have one MAC address which can connect to the port. When another MAC address connects to the port, it, correctly, raises a security violation. – Ron Maupin Apr 7 '16 at 16:13
  • Do you know definitively how many authorized devices are going to connect to switch 2? If you not worried about unauthorized persons pluging into that switch port just run "no switchport security" from the G2/26 interface sub menu. You'll still see the port security settings in the config file but they would be in effect. – Brian Duke Apr 7 '16 at 19:30
  • I will need to connect 8 devices maximum on switch 2. I guess the modification to the command proposed by @LukasNagy switch1(config-if)#switchport port-security maximum 8 should do. Right? – NTD Apr 8 '16 at 11:08
2

The problem is, that by default, maximum number of secure mac address is 1. So when the switch 1 learns about the first PC, it will save MAC of PC as secure MAC. Second PC's MAC is not secure, therefore port-security violation occurs, restricting traffic.

You can solve this by increasing maximum number of secure MAC adresses using command

switch1(config-if)#switchport port-security maximum 2

EDIT: Fixed up the syntax

-3

If I am understanding this correctly your setup is

                           PC1
Switch 1 <----> Switch 2 <
                           PC2

If this is the case, the connection between your two switches needs to be a trunk, not an access port.

Switch 1 <---trunk---> Switch 2, off of Switch 2, each PC connects to an access port.

Access ports are basically a host port, where you should usually only have one end device. If there are to be multiple hosts behind it, the inter-switch connection needs to be a trunk.

  • 2
    This is incorrect. Access ports only carry one untagged VLAN. Trunk ports carry multiple VLANs with at most one untagged. If all hosts are in the same VLAN, the interconnect between two hosts can be access ports without any problems. – Teun Vink Apr 7 '16 at 15:14
  • Between 2 hosts yes both can be an access port, but this is not between 2 hosts, this is 2 hosts on one switch carrying to another switch. Switch 1 will only see one mac address in its table when configured as an access port on switch 1. – Ippy Apr 7 '16 at 15:18
  • 3
    Sorry, but this is still totally wrong. Trunk and access mode have nothing to do with the number of devices connected, it has to do with VLAN tagging. – Teun Vink Apr 7 '16 at 15:26
  • @Ippy Layer 2 switches don't modify the frame header like a router does to a packet header. They simply copy and transmit frames back out the other ports based on their learned or static arp table. Switch 1 will be able to see the PC1 and PC2s MAC addresses. – Brian Duke Apr 7 '16 at 19:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.