I haven't tried moving them to other ports and no firewalls are installed on the PCs. However if I toggle port-security on one of the PCs you can definitely see the difference (turned on it can not be pinged by this one machine nor vice versa).
Here's a sample config of what I use:
version 12.2
no service pad
service timestamps debug uptime
service timestamps log datetime
service password-encryption
service sequence-numbers
!
hostname switchA
!
enable secret 5 blah
enable password 7 blah
!
username blah password blah
aaa new-model
aaa authentication login default group tacacs+ local
aaa authorization config-commands
aaa authorization exec default group tacacs+ local
aaa authorization commands 15 default group tacacs+ none
aaa accounting auth-proxy default start-stop group tacacs+
!
!
aaa session-id common
clock timezone UTC -5
clock summer-time UTC recurring
ip subnet-zero
!
ip dhcp snooping vlan 1
ip dhcp snooping
!
cluster commander-address mem
!
no file verify auto
spanning-tree mode pvst
spanning-tree portfast bpduguard default
spanning-tree extend system-id
!
vlan internal allocation policy ascending
!
interface FastEthernet0/1
switchport mode access
switchport port-security maximum 2
switchport port-security
switchport port-security aging time 1
switchport port-security violation protect
switchport port-security aging type inactiv
spanning-tree portfast
ip dhcp snooping limit rate 100
!
interface GigabitEthernet0/1
switchport trunk encapsulation dot1q
switchport mode trunk
ip dhcp snooping trust
!
interface GigabitEthernet0/2
switchport mode dynamic desirable
!
interface GigabitEthernet0/3
!
interface GigabitEthernet0/4
!
interface Vlan1
ip address 10.10.10.1 255.255.252.0
no ip route-cache
!
ip classless
ip http server
ip http access-class 1
ip http secure-server
!
snmp-server community
snmp-server community
tacacs-server host 10.10.10.6
tacacs-server directed-request
tacacs-server key 7 blah
radius-server host 10.10.10.6 auth-port 1645 acct-port 1646 key 7 blah
radius-server source-ports 1645-1646
radius-server vsa send accounting
radius-server vsa send authentication
!
control-plane
!
alias exec macsh sh mac-address | include
alias exec arpsh sh arp | include
!
line con 0
line vty 0 4
access-class 1 in
password 7 blah
line vty 5 15
password 7 blah
!
ntp clock-period 36029099
ntp server 10.10.10.9
end
