We have 3750G stacks that were recently configured with port-security mac-address sticky
on all access ports. A good question was raised about whether this is
the best or not for our needs, seeing as half of our users use
laptops/docking stations. We need these users to have mobility around
the office, e.g. undocking their laptop and bringing it to the
conference room to use for a presentation. I've read the manual about
how to configure these things, but am not sure what the best
strategy/practice is.
So, to allow this mobilty but still use port-security, is using the sticky
command a good idea? Or would that be best served for static things
like desktops and printers, etc? Is there a global command that can be
issued to allow secure MAC addresses to move between ports on the
stack? If sticky isn't the thing to use, what is? Maybe just a simple
config on each laptop port such as:
switchport mode access
switchport port-security
switchport port-security maximum 2
switchport port-security violation restrict
switchport port-security aging type inactivity
switchport port-security aging time 60
Hi,
Normal recommendation to turn on port security and set the maximum MAC addresses to 1 (the default) or 2 (if there is an IP phone connected). The default behavior is to disable the port when the MAC changes or if the number of concurrent MAC’s exceeds the maximum.
switchport port-security mac-address sticky – turns on the sticky MAC feature
After enabling, you will notice the currently connected MAC address(es) will appear in the running config: This will stay in the config until the switch is rebooted, so it’s important to write the config.
When you use sticky MAC addresses you'll want to make sure that the MAC addresses are cleared off of a switch when a device is moved. Just for example situation can happen like this if stick mac is enabled,laptop that was moved from one client location to another and one of the distribution switches was thinking the device was plugged into the old switch and the other distribution switch thought it was plugged to the new switch. This created a situation where some network traffic was reaching the laptop and some was going into a black hole. After clearing the the sticky MAC addresses on the old switch the problem was resolved.
Hope to help !!
Remember to rate the helpful post
Ganesh.H
