0

How to configure port security on trunk and interfaces

I'm learning about port security and have a few questions. I have a layer 2 switch with interfaces f0/1-22 in access mode to access VLANs, interfaces f0/23-24 in trunk mode to connect to layer 3 switch, and interfaces g0/1-2 that aren't used.

enter image description here

Should I enable port security on the 2 interfaces and on 2 unused interfaces?

When I applied port security to the 2 trunk interfaces, they went down. Should I remove the port security configuration or try to fix it? And what can I do if I have to?

If I need to fix the configuration, what are the steps to follow to bring the trunk interfaces back up while ensuring proper port security?

Any help or advice on best practices for configuring port security on a layer 2 switch would be appreciated.

1
  • 1
    Generally, you configure port-security only on user (host) access ports.
    – Ron Trunk
    Apr 25, 2023 at 13:41

1 Answer 1

2

You can use port security on a trunk interface. For example, you might use a trunk interface to a user device that needs more than one VLAN tagged on it such as a SIP phone or similar (when Voice VLAN or LLDP is not possible/supported). However, using it requires significant testing and preparation, as you have seen.

Using port security on inter-switch links that function as VLAN trunks (carrying multiple tagged VLANs) is very complex and can be very frustrating unless you have very detailed control of the network and user devices.

You would usually use port security on the access ports for end user devices. If you use it on trunk ports between switches, you must first document and allow all possible user device MAC addresses otherwise it will result in the trunk link being disabled once an unapproved MAC address traverses the trunk link (or you exceed the allowed total MAC addresses on the VLAN).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.