Port Security and Access Control

Port security is a Layer 2 feature on Cisco switches that protects the network by limiting and identifying MAC addresses allowed on a switch port.

Key concepts:

• Static secure MAC addresses: manually configured MAC addresses bound to a port.
• Dynamic secure MAC addresses: learned MAC addresses that are added to the running configuration and removed when the switch reloads.
• Sticky secure MAC addresses: learned and automatically saved to the startup configuration.
• Violation modes:
  • protect: drops unauthorized frames, no notification.
  • restrict: drops unauthorized frames and increments the violation counter.
  • shutdown: disables the port and brings it into err-disable state.

Common commands:

• switchport mode access
• switchport port-security
• switchport port-security maximum <number>
• switchport port-security mac-address <mac>
• switchport port-security mac-address sticky
• show port-security
• show port-security interface <interface>

Use cases:

• Prevent MAC flooding and unauthorized devices on access ports.
• Enforce endpoint access policy on user-facing switch ports.

Access control in CCNA covers methods that govern who can use network resources and how traffic is permitted or denied.

Types of access control:

• ACLs (Access Control Lists): packet filters applied to interfaces to permit or deny traffic.
  • Standard ACLs: filter by source IP only.
  • Extended ACLs: filter by source IP, destination IP, protocol, and ports.
• Layer 2 access control: features such as port security, 802.1X, and private VLANs.
• Role-based access control: grant different privileges based on user or device type.

ACL basics:

• Apply standard ACLs close to the destination for simplicity.
• Apply extended ACLs close to the source to reduce unnecessary traffic.
• Implicit deny at the end of every ACL.
• Use numbered or named ACLs.

Example ACL configuration:

• Standard ACL:
  • access-list 10 permit 192.168.1.0 0.0.0.255
  • ip access-group 10 in
• Extended ACL:
  • access-list 110 permit tcp any host 10.0.0.10 eq 80
  • ip access-group 110 in

Best practices:

• Document ACL purpose and order.
• Use specific rules before general rules.
• Monitor and test ACLs to avoid service disruption.

Port security is a form of Layer 2 access control focused on switch port behavior and device authentication.

ACLs operate at Layer 3/4 and control traffic flow through routers and switches.

Together they help secure network access by limiting both which devices connect and what traffic they can send or receive.