Best Practices for Configuring Port Security on a Layer 2 Switch

Question

How to configure port security on trunk and interfaces

I'm learning about port security and have a few questions. I have a layer 2 switch with interfaces f0/1-22 in access mode to access VLANs, interfaces f0/23-24 in trunk mode to connect to layer 3 switch, and interfaces g0/1-2 that aren't used.

Should I enable port security on the 2 interfaces and on 2 unused interfaces?

When I applied port security to the 2 trunk interfaces, they went down. Should I remove the port security configuration or try to fix it? And what can I do if I have to?

If I need to fix the configuration, what are the steps to follow to bring the trunk interfaces back up while ensuring proper port security?

Any help or advice on best practices for configuring port security on a layer 2 switch would be appreciated.

Answer 1

You can use port security on a trunk interface. For example, you might use a trunk interface to a user device that needs more than one VLAN tagged on it such as a SIP phone or similar (when Voice VLAN or LLDP is not possible/supported). However, using it requires significant testing and preparation, as you have seen.

Using port security on inter-switch links that function as VLAN trunks (carrying multiple tagged VLANs) is very complex and can be very frustrating unless you have very detailed control of the network and user devices.

You would usually use port security on the access ports for end user devices. If you use it on trunk ports between switches, you must first document and allow all possible user device MAC addresses otherwise it will result in the trunk link being disabled once an unapproved MAC address traverses the trunk link (or you exceed the allowed total MAC addresses on the VLAN).