So on gigabit 103, we want to automatically add the Mac address to the running configuration
so that we limit specific Mac addresses on that port.
So to do that
on interface gigabit103, we're going to type switch mode access has to be an access port
switch port, port security Mac address
sticky that allows the switch to automatically learn the Mac address of a PC and write it to the running
configuration. Switch port port security,
show port security notice on this port
maximum Mac addresses allowed is 1, nothing's been learnt at the moment, there's been no violations
show run.
On this port
we've got our configuration, but we don't see any Mac addresses in the running configuration show port
security gigabit 103,
interface gigabit 103 rather, we've enabled port security status is secure up, violation mode
shut down maximum number of Mac addresses allowed is one at the moment
we haven't learnt any Mac addresses.
So on PC 3
what I'll do is use IP config, slash, renew to force the PC to request an IP address, it's been given
one.
So show port security interface gigabit 103.
Notice we've now learned to Mac address on that interface, total number of Mac addresses is one Sticky
Mac addresses is one.
So notice the difference,
show run
Shows us the Mac address in the running configuration of the switch, we didn't type that command,
it was automatically added to the running configuration.
So again, show port security shows us that one Mac address has been learnt.
Maximum is one on this port.
On that interface, we've learnt this Mac address.
Which means it's written to the running configuration total Mac addresses is one maximum Mac addresses
is one a violation results in the port being shut down.
If you look at addresses, we've learnt this Mac address in VLAN 1 onto this port, it's a secure,
sticky Mac address, which means, again, that it's written to the running configuration.
So what happens when the second host sends traffic?
So PC 4 IP CONFIG slash renew.
On the switch notice, we get a violation of the port is shut down, so port security address, this
address is allowed on this port, but we learnt about a different address.
On that port so show port security interface gigabit 103 shows us the last Mac address
learnt violation mode is shut down.
So the port has now been shut down.
Previously.
the violation mode was shut down, but the port was up.
But because the violation took place, the port is now shut down and in packet tracer, we can see
that the port is shut down.
So what happens if we reboot to the switch, if I save the config to this point?
This will be written to the saved configuration of the switch, but if I save the config before that
point.
That configuration is not written to the saved configuration of the switch.
Which means that a different Mac address could be learnt, I'll no shut the port again and save the configuration.
So at the moment and I need to shut and then no shut actually.
So interface gigabit 103 shut and then not shut the port to bring it up and save the configuration.
So again
assume at this point that the switch hasn't learnt a Mac address, that's the running configuration
show port security, at the moment
the switch has not learnt a Mac address on this port.
Send traffic from PC 3
switch has now learnt about a Mac address, on that port it's learnt about this Mac address.
So in other words, in the running configuration and in the Mac address table, the switch knows about
this Mac address.
There's the Mac address in the Mac address table.
There's the Mac address in the running configuration, but in the startup configuration
We don't have that Mac address, so if the switch is now power cycled, what you'll notice is that the
switch can learn a different Mac address on that port.
So again show Mac address table.
No Mac addresses are learnt at the moment, show run, that Sticky Mac address has been lost.
So if this PC was the first PC to send out a DHCP request.
That's the Mac address that would be learnt on
Gigabit 103 of the switch
and notice, that's what's happened here, this Mac address was written to the running config was previously
we had the Mac address of PC3.
Notice that port has gone down now show port security.
We've had a violation take place
on that port and the devices that are violated was PC3.
So what's the point of using Sticky Mac addresses?
What does it do and what doesn't do?
Well, Sticky Mac addresses save you the trouble of finding the Mac addresses of devices and writing
that to the running configuration. On the last port
we're going to have to manually configure the Mac addresses.
So that means that you need to find out what the Mac addresses are of your devices.
Sticky saves you the trouble because it automatically learns the Mac address and then writes it to the
running configuration.
But that means that the first device that sends traffic into the network needs to be the device that
you trust.
In other words, it needs to be the device that you want connected to that port.
If another device sends traffic that devices Mac address will be written to the running configuration
and not to the Mac address of the device that you actually want on that port.
Secondly, sticky configuration is written to the running config of the switch.
You have to save the switch configuration if you want to make that permanent.
So again, on this port interface, gigabit 103, let's remove this command
and I'll shut the port down and then no, shut it.
So at the moment, no Mac address has been learnt on that port.
I'll send a DHCP request from PC 3.
Hopefully what should happen now is PC3s Mac address should be written to the running config of the
switch.
Have to wait for spending tree to converge.
So let's try that again.
There you go, PC3s Mac address has been written to the running config.
I'm going to save the config at this point.
So now we've been able to learn the Mac address of PC three and save it to the running config of the
switch, and I've been able to save it to the Start-Up config of the switch.
So it's both in the startup configuration.
As you can see there, as well as
the running configuration.
But notice the problem, this port is now being shut down because PC four sent traffic, so notice the
difference between start up and running config shows.
Start up config shows us that configuration
with the port enabled.
So running config shows us that configuration with the port shut down.
So if I reloaded or rebooted to the switch or it lost power and came back again.
It will revert back to the state that we wanted to be in.
Which essentially means that it only allows traffic on gigabit one zero three from the Mac address that's
different to gigabit 101 where any Mac address could send traffic as long as it was the first
Mac address to send traffic.
So Sticky Mac addresses make your life a lot easier.
Let's configure port security on gigabit 104 by manually configuring the Mac address.