how to port security with dynamically learned mac addresses

Port security has a sticky MAC addresses feature that can limit switch port access to a single, specific MAC address without the network administrator having to gather the MAC address of every legitimate device and manually associate it with a particular switch port. Implementing this level of security, however, requires considerable administrative overhead. The most restrictive port security implementation would specify the exact MAC address of the single device that is to gain access through each port. This prevents intruders from using multiple MAC addresses over a short time period but does not limit port access to a specific MAC address. Port Security can also mitigate spoofing attacks by limiting access through each switch port to a single MAC address. If you limit the number of secure MAC addresses to one and assign a single secure MAC address, the device attached to that port has the full bandwidth of the port. When you assign secure MAC addresses to a secure port, the port does not forward ingress traffic that has source addresses outside the group of defined addresses. Port Security restricts a port’s ingress traffic by limiting the MAC addresses that are allowed to send traffic into the port. “Sticky learning” combines dynamically learned and statically configured addresses. Port security is configured on untrusted user ports. You can use port security with dynamically learned and static MAC addresses. It’s a Cisco-proprietary feature on Catalyst switches (disabled by default). Enabling port security limits MAC flooding attacks and locks down the port.Ĭonfigure port security to define the number of MAC addresses allowed on a given port. To prevent MAC Address flooding, Port Security can be used. Once MAC addresses are assigned to a secure port, the port does not forward frames with source MAC addresses outside the group of defined addresses. Port Security on interfaces that use voice VLANsīy limiting the number of permitted MAC addresses on a port, port security can be used to control unauthorized expansion of the network. Mitigating MAC Spoofing and MAC Table Overflow Attacks

How to port security with dynamically learned mac addresses