Hello,
I have a POE Switch C2960X Software (C2960X-UNIVERSALK9-M), Version 15.2(2)E5. I have configured on a certain port voice and access VLAN. I have a cisco phone connected to this port and a PC connected to the IP phone. I also configured port security based on sticky mac-addresses.
Following is the configuration:
interface GigabitEthernet1/0/4
switchport access vlan 21
switchport mode access
switchport voice vlan 60
switchport port-security maximum 2
switchport port-security maximum 1 vlan access
switchport port-security maximum 1 vlan voice
switchport port-security mac-address sticky
switchport port-security mac-address sticky 7427.ea66.4875
switchport port-security mac-address sticky 0027.9081.1224 vlan voice
switchport port-security
spanning-tree portfast
end
The problem is as following, when setting the port-security maximum to '2' which i'm assuming is mandatory in my case to handle two devices on the same port, I tried to plug another PC and then the MAC value '7427.ea66.4875' was overridden by a new MAC belonging to the new PC. No violation was triggered! the new PC gained access over the network normally, this contradicts the entire concept of port-security. How can i overcome this security gap? Am i configuring something wrong? Is there any suggested best practice for configuring port-security over a physical port hosting two devices (IP phone & PC) in different Vlans (Voice and access) ?
Thanks,
