Protocol Atlas

L2 · security · draft

Port security

Switch port security and DHCP snooping basics

Limits which source MAC addresses may use an access port, and builds a DHCP binding table so untrusted ports cannot answer as servers.

Presenter modeEmbed this figure

Cisco IOS XE 17.15 — Port Security (Catalyst 9300) §Information About Port SecurityCisco Catalyst — DHCP Snooping and IP Source Guard §DHCP SnoopingIEEE 802.3-2022 §3.1Protocol SummaryRFC 2131 · DRAFT STANDARD · March 1997

Why it exists

An open access port learns every source MAC that appears. A hub, a misplugged uplink, or a hostile station can fill the table or impersonate another host. Port security bounds which addresses that port may present. Cisco IOS XE 17.15 — Port Security (Catalyst 9300) §Information About Port Security

DHCP is worse when any port can answer as a server: a rogue Offer steals clients. Snooping marks where server messages are allowed and records bindings from legitimate leases. Cisco Catalyst — DHCP Snooping and IP Source Guard §DHCP Snooping

One port, a finite set of source MACs

Port security caps how many source MAC addresses an access port may learn. The first frames teach the switch which addresses are allowed.

PC · MAC ASW1 · max 1Port-security: max 1 · learningRest of LANaccess
  • Link
  • Blocking
  • Packet in flight
  • Discarded
  • Emphasis
Select a device to read its state. Arrow keys walk the topology.
Text equivalent of this diagram
Devices and links at this step
ElementKindState
PC · MAC Ahost—
SW1 · max 1switchPort-security: max 1 · learning
Rest of LANcloud—
PC · MAC A — SW1 · max 1linkup · access
SW1 · max 1 — Rest of LANlinkup
1 / 3

Port security is enabled on the access port with maximum 1. Until a frame arrives, the secure address list for that port is empty.

What changed

  • SW1 · max 1: Port-security → max 1 · learning
  • Emphasis on PC · MAC A ↔ SW1 · max 1

How it works

Port security counts distinct source MAC addresses seen on a port against a configured maximum. Frames from addresses outside the allowed set trigger the violation mode. IEEE 802.3-2022 §3.1

Sticky learning writes dynamically learned secure addresses into the running configuration so they survive a restart after the config is saved. Cisco IOS XE 17.15 — Port Security (Catalyst 9300) §Sticky Secure MAC Addresses

DHCP snooping, enabled per VLAN, treats ports as untrusted by default. Server messages from untrusted ports are dropped; trusted ports build the binding table used by later features such as IP source guard. Cisco Catalyst — DHCP Snooping and IP Source Guard §DHCP Snooping Configuration Guidelines

On the wire

Constructed examples, encoded from the field table below them — not captured traffic.

An ordinary frame. The group bit in the first octet of the destination is clear, so a switch forwards it to one port rather than flooding it.

Physical
A preamble and start-of-frame delimiter precede this, and the hardware removes them before any capture sees the frame. IEEE 802.3-2022
MAC header
Destination address, source address, and the EtherType naming the payload. IEEE 802.3-2022
Payload and FCS
Between 46 and 1500 octets, padded to the minimum, followed by a four-octet frame check sequence. IEEE 802.3-2022

Configure it

Limit MACs on an access port and enable DHCP snooping with a trusted uplink.

Cisco IOS-XE 17.15 · Catalyst 9300, Catalyst 9200draft

  1. interface GigabitEthernet1/0/1
 switchport mode access
 switchport port-security
 switchport port-security maximum 2
 switchport port-security violation restrict
 switchport port-security mac-address sticky

    Maximum 2 for phone+PC patterns; restrict drops offenders without err-disabling the port; sticky persists learned MACs in running-config.

    Common mistake: maximum 1 with violation shutdown on a port that will see a phone and a PC.

    Cisco IOS XE 17.15 — Port Security (Catalyst 9300) §How to Configure Port Security

  2. ip dhcp snooping
ip dhcp snooping vlan 10

    Feature is inert on a VLAN until enabled there. Global alone is not enough.

    Cisco Catalyst — DHCP Snooping and IP Source Guard §Enabling DHCP Snooping

  3. interface GigabitEthernet1/0/48
 ip dhcp snooping trust

    Uplink toward the real DHCP server or relay. Without trust, server messages are dropped.

    Cisco Catalyst — DHCP Snooping and IP Source Guard §DHCP Snooping Configuration Guidelines

Verify

show port-security interface GigabitEthernet1/0/1
Maximum, violation mode, and address count — not sample dumps.
show ip dhcp snooping
Enabled VLANs and which interfaces are trusted.
show ip dhcp snooping binding
Learned bindings after a successful lease.

Caveats

  • Sticky addresses must be saved to startup-config if they should survive reload.
  • Option 82 insertion can break servers that do not expect it; disable only with intent.

When it breaks

Symptom first, because that is what you have when it happens.

  1. An access port goes err-disabled after a laptop, phone, or dock appears on a port with maximum 1.

    Narrow it down

    1. show port-security interface and check maximum versus addresses in use.
    2. Identify whether violation mode is shutdown.
    3. Look for a second device or a NIC team presenting two MACs.

    Cause

    Source MAC count exceeded the configured maximum; shutdown took the port down.

    Fix

    Raise maximum to match the attached devices, or use restrict and clear the sticky entry if the wrong MAC was learned first.

    Cisco IOS XE 17.15 — Port Security (Catalyst 9300) §How to Configure Port Security

  2. A replacement PC cannot pass traffic until someone clears port security; the old MAC is still sticky.

    Narrow it down

    1. show port-security address for the sticky entry.
    2. Confirm the running and startup configs still list the old MAC.
    3. Check whether aging is disabled so the address never leaves.

    Cause

    Sticky address from the previous station remains the only allowed MAC.

    Fix

    Clear the sticky address (and save config) or reconfigure the secure MAC for the new station.

  3. After enabling DHCP snooping, no client on the VLAN receives a lease.

    Narrow it down

    1. Verify snooping is on for the client VLAN.
    2. Confirm the path toward the DHCP server (or relay) is trusted.
    3. Check whether Option 82 insertion breaks a server that rejects it.

    Cause

    Server messages arrive on untrusted ports and are dropped, or Option 82 surprises the server.

    Fix

    Trust the server-facing interfaces; disable Option 82 insertion only when the server path requires it.

    Cisco Catalyst — DHCP Snooping and IP Source Guard §DHCP Snooping Configuration Guidelines

  4. Clients still get addresses from an unexpected server after snooping was “enabled”.

    Narrow it down

    1. Confirm the feature is enabled on the VLAN, not only globally.
    2. Check whether the rogue’s port was mistakenly trusted.
    3. Verify clients are on a VLAN where snooping is active.

    Cause

    Snooping inactive on that VLAN, or the rogue port marked trusted.

    Fix

    Enable per VLAN and leave client and rogue ports untrusted.

  5. IP source guard or DAI drops a host that uses a static IP and never spoke DHCP.

    Narrow it down

    1. Inspect the snooping binding table for that MAC and IP.
    2. Confirm the host obtained its address without DHCP.
    3. Check whether a static binding was configured.

    Cause

    Bindings are learned from DHCP exchanges. Static hosts never create one.

    Fix

    Add a static binding for that MAC/IP/port, or exempt the port from the dependent feature.

Design notes

Size the maximum for the real topology: a phone and a PC need at least two; a hypervisor uplink needs far more or should not use a tight limit.

Prefer restrict or protect over shutdown on ports where err-disable takes down a working user for a transient second MAC.

Snooping without trusting the real server path blackholes DHCP for everyone. Enable the feature and mark trust in the same change window.

Misconceptions

“Port security filters on IP address like an ACL.”
It counts and allows source MAC addresses on a Layer 2 port. IP filtering is a different mechanism. Cisco IOS XE 17.15 — Port Security (Catalyst 9300) §Information About Port Security
“Untrusted ports cannot send DHCP Discovers.”
Untrusted ports may originate client messages. What they must not originate are server messages such as Offer and Ack. Cisco Catalyst — DHCP Snooping and IP Source Guard §DHCP Snooping
“Shutdown is always the right violation mode.”
Shutdown err-disables the whole port, including legitimate devices sharing it. Restrict drops the offender and keeps allowed MACs forwarding. Cisco IOS XE 17.15 — Port Security (Catalyst 9300) §How to Configure Port Security

More walkthroughs

A second MAC trips the violation modefailure

Maximum is one. A new source MAC appears — sticky learning had pinned the first. Violation mode decides whether the port err-disables or only drops the offender.

PC · MAC ALaptop · MAC BSW1Secure: sticky ALANsame portsame port
  • Link
  • Blocking
  • Packet in flight
  • Discarded
  • Emphasis
Select a device to read its state. Arrow keys walk the topology.
Text equivalent of this diagram
Devices and links at this step
ElementKindState
PC · MAC Ahost—
Laptop · MAC Bhost—
SW1switchSecure: sticky A
LANcloud—
PC · MAC A — SW1linkup · same port
Laptop · MAC B — SW1linkup · same port
SW1 — LANlinkup
1 / 3

Sticky learning converted dynamic MAC A into a running-config secure address. Reloads keep A without re-learning from scratch — if the config was saved.

What changed

  • SW1: Secure → sticky A
  • Emphasis on PC · MAC A ↔ SW1

Untrusted ports cannot be DHCP serversfailure

DHCP snooping treats client ports as untrusted: server messages (Offer, Ack) from them are dropped. Only trusted uplinks toward real servers may carry those replies.

ClientSW · snoopingDHCP snooping: on · VLAN 10Rogue DHCPReal DHCPuntrusteduntrustedtrusted
  • Link
  • Blocking
  • Packet in flight
  • Discarded
  • Emphasis
Select a device to read its state. Arrow keys walk the topology.
Text equivalent of this diagram
Devices and links at this step
ElementKindState
Clienthost—
SW · snoopingswitchDHCP snooping: on · VLAN 10
Rogue DHCPhost—
Real DHCPhost—
Client — SW · snoopinglinkup · untrusted
Rogue DHCP — SW · snoopinglinkup · untrusted
SW · snooping — Real DHCPlinkup · trusted
1 / 4

Snooping is enabled globally and on the client VLAN. By default every port in that VLAN is untrusted until marked otherwise.

What changed

  • SW · snooping: DHCP snooping → on · VLAN 10
  • Emphasis on SW · snooping

Terms

Sticky MAC
A dynamically learned port-security address written into the running configuration so it can persist across reload once the config is saved.
DHCP snooping
A switch feature that drops DHCP server messages on untrusted ports and records MAC-to-IP bindings from leases learned via trusted ports.
Violation mode
How port security reacts when a frame’s source MAC exceeds the allowed set: protect and restrict drop (restrict also counts/logs); shutdown err-disables the port.

Check yourself

  • Port security maximum 1 is configured. What does the switch count?
  • What does sticky MAC learning store addresses into?
  • Default violation mode shutdown does what on excess MAC?
  • How does violation mode restrict differ from shutdown?
  • Which DHCP messages does snooping drop on an untrusted port?
  • What does the DHCP snooping binding table record?
  • DHCP snooping is enabled globally but not on the client VLAN. Result?
  • An IP phone and a PC share one access port. What maximum is realistic?