Access Switch Port Restrictions

Switch port access restriction is implemented using port security and port isolation to control which devices can connect and communicate through a switch port.

Port Security Overview

Port security is a feature on switches that limits and identifies the MAC addresses allowed on a specific port, preventing unauthorized devices from accessing the network. It works only on access ports, which connect end devices to the switch, and is not supported on EtherChannel, private VLAN, or 802.1X authenticator interfaces .

Key Features:

• MAC Address Limiting: You can restrict the number of devices on a port, with a maximum of 132 MAC addresses per port .
• MAC Address Assignment:
  • Static: Manually configured and stored in the running configuration.
  • Dynamic: Learned automatically and removed on switch restart.
  • Sticky: Dynamically learned but saved to the running configuration for persistence .
• Violation Handling Modes:
  • Shutdown: Default mode; port is disabled when a violation occurs.
  • Restrict: Port remains active; unauthorized traffic is dropped and logged.
  • Protect: Port remains active; unauthorized traffic is dropped without logging .

Aging and Bandwidth

• Secure MAC addresses can age out based on absolute or inactivity timers, controlling how long a learned address remains valid .
• Limiting to a single MAC address ensures the connected device receives full port bandwidth .

Port Isolation

Port isolation prevents traffic between specific ports, even within the same VLAN, while still allowing access to uplinks or the Internet. This is useful in multi-tenant environments or for security segmentation .

Implementation:

• Isolation can be enabled per port or in bulk.
• Isolated ports cannot communicate with each other, but can communicate with non-isolated ports or uplinks.
• Configuration is typically done via the switch management interface or dashboard, depending on the vendor .

Best Practices

• Use static or sticky MAC addresses for critical devices to enhance security.
• Set the violation mode according to risk tolerance: Shutdown for strict security, Restrict for monitoring, Protect for minimal disruption.
• Combine port security with port isolation to prevent lateral movement between devices.
• Monitor and configure aging timers to balance security and operational flexibility . By implementing these mechanisms, network administrators can effectively restrict access, prevent unauthorized devices, and control traffic flow on switch ports, enhancing overall network security.