1

I am designing my new company building network with Cisco 2960x and 3850ss switches and I want to use port-security for security reasons. I know how to configure 3 types of sticking MAC addresses to a port but I need to know if it is possible to stick some MAC addresses globally to all switches (for help-desk) and after that use port-security sticky command to switch learn latest connected MAC address automatically.

1

You cannot define it company wide, but per device. Use the interface range configuration to apply the configuration to all relevant ports of one device:

interface range Gi 0/1-20

Then set a maximum number of allowed MAC addresses:

switchport port-security maximum 3

Define the two MAC addresses of your help desk as static:

switchport port-security mac-address a1b1.c1d1.e1f1
switchport port-security mac-address a2b2.c2d2.e2f2

Define the ports as sticky afterwards:

switchport port-security mac-address sticky

You could apply this config company wide by using SNMP, SSH, etc. but not by a master device like it works with VTP.

  • Thank you Thomas.what about this cisco doc :If a secure MAC address is secured on a port, that MAC address is not allowed to enter on any other port off that VLAN. If it does, the packet is dropped unnoticed in the hardware. Other than through the interface or port counters, you do not receive a log message reflecting this fact. Be aware that this condition does not trigger a violation. Dropping these packets in the hardware is more efficient and can be done without putting additional load on the CPU. – hamid Jul 7 '20 at 19:32
  • @hamid Do you really have devices that share the same MAC address? – Thomas Jul 8 '20 at 5:30
  • I am speaking about helpdesk laptop – hamid Jul 9 '20 at 20:04
  • @hamid I assume, you do not use the same MAC address on multiple devices, even if they are "helpdesk laptops". As you cannot plug them in on multiple switches/ports at the same time (without using hubs and other switches), you won't have any problems. – Thomas Jul 10 '20 at 5:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.