How can I allow my laptop MAC address on every port with port security? Is it even possible?
When I try, I get this:
SW2(config-if)#switchport port-security mac-address XXXX.XXXX.XXXX Found duplicate mac-address XXXX.XXXX.XXXX.
Please allow me to join the discussion.
Why would you even want to allow your Laptop MAC address on all switch ports with port security ?
The port security feature is mainly meant to increase Layer 2 security e.g. prevent MAC overflow attacks on a switch. It's not meant to prevent unauthorized devices to be connected to a RJ45 socket aka Ethernet port. Normally you configure the RJ 45 sockets in your office that are terminated on a Patch Panel and connected to the switch to allow a certain amount of MAC the given port can learn before taking any action (protect, restrict, shutdown). In doing so you're preventing from a possible MAC overflow attack's that can be executed against your switch.
Again (it's my personal opinion) the question doesn't make much sense. If you can prove there's a real life reason why you would even care of configuring it that way, let me know.
You probably will want to look into port-security sticky (dynamically learns the MAC) then configure aging to age out old MAC Addresses on each interface. You wont be able to have port security configured and at the same time allow a MAC to move from interface to interface without problems. As stated above, it defeats the purpose of port-security.
For each interface you can configure it to dynamically learn the mac with:
switchport port-security mac-address sticky
You can set how many MAC Address's you want each interface to learn:
switchport port-security maximum ? <1-8192> Maximum addresses
Then for each interface set the aging timers:
switchport port-security aging ? static Enable aging for configured secure addresses time Port-security aging time type Port-security aging type
When you set your aging parameters you have several options, you can have it based on time, or type, or statically set:
switchport port-security Aging time ? <1-1440> Aging time in minutes. Enter a value between 1 and 1440 switchport port-security Aging type ? absolute Absolute aging (default) inactivity Aging based on inactivity time period
Like Ron says in his response, you will want to have port-security to dynamically learn (sticky) the MAC addresses, possible set a max amount to learn on each interface, and configure the aging parameters to what best suits you.
That defeats the purpose of one aspect of port security:
If traffic with a secure MAC address that is configured or learned on one secure port attempts to access another secure port in the same VLAN, applies the configured violation mode.
The MAC address table of the switch will only allow a single MAC address on a single port so that it knows, in a deterministic manner, to which port it should send traffic with that destination address. MAC address spoofing is an attack which will cause disruption by bouncing the MAC address table among two or more ports.
This aspect of port security prevents that from happening.
Port security can be used without specifying exact MAC addresses. A port can dynamically learn a MAC address, and keep it on that port for a specified time period.
Cisco has documents which explain port security in detail, e.g. Chapter: Port Security:
Port Security with Dynamically Learned and Static MAC Addresses
You can use port security with dynamically learned and static MAC addresses to restrict a port's ingress traffic by limiting the MAC addresses that are allowed to send traffic into the port. When you assign secure MAC addresses to a secure port, the port does not forward ingress traffic that has source addresses outside the group of defined addresses. If you limit the number of secure MAC addresses to one and assign a single secure MAC address, the device attached to that port has the full bandwidth of the port.
A security violation occurs in either of these situations:
- When the maximum number of secure MAC addresses is reached on a secure port and the source MAC address of the ingress traffic is different from any of the identified secure MAC addresses, port security applies the configured violation mode.
- If traffic with a secure MAC address that is configured or learned on one secure port attempts to access another secure port in the same VLAN, applies the configured violation mode.
Note After a secure MAC address is configured or learned on one secure port, the sequence of events that occurs when port security detects that secure MAC address on a different port in the same VLAN is known as a MAC move violation.
See the "Configuring the Port Security Violation Mode on a Port" section for more information about the violation modes.
After you have set the maximum number of secure MAC addresses on a port, port security includes the secure addresses in the address table in one of these ways:
- You can statically configure all secure MAC addresses by using the switchport port-security mac-address mac_address interface configuration command.
- You can allow the port to dynamically configure secure MAC addresses with the MAC addresses of connected devices.
- You can statically configure a number of addresses and allow the rest to be dynamically configured.
If the port has a link-down condition, all dynamically learned addresses are removed.
Following bootup, a reload, or a link-down condition, port security does not populate the address table with dynamically learned MAC addresses until the port receives ingress traffic.
A security violation occurs if the maximum number of secure MAC addresses have been added to the address table and the port receives traffic from a MAC address that is not in the address table.
You can configure the port for one of three violation modes: protect, restrict, or shutdown. See the "Configuring Port Security" section.
To ensure that an attached device has the full bandwidth of the port, set the maximum number of addresses to one and configure the MAC address of the attached device.