Cisco port security - static vs sticky+static

[SJ K]

I don't see a different between the two. Both make it to the running config.

1) sticky + static

    Switch1(config-if)#switchport port-security mac-address sticky ?
      H.H.H  48 bit mac address

    Switch1(config-if)#switchport port-security mac-address sticky ae11.be22.ce33

2) static only

    Switch1(config-if)#switchport port-security mac-address ?
      H.H.H   48 bit mac address

    Switch1(config-if)#switchport port-security mac-address ae12.be22.ce33

In Running Config

 interface GigabitEthernet1/0/17
     switchport access vlan 4
     switchport mode access
     switchport voice vlan 5
     switchport priority extend trust
     switchport port-security maximum 5
     switchport port-security mac-address sticky
     **switchport port-security mac-address sticky ae11.be22.ce33
     switchport port-security mac-address ae12.be22.ce33**
     duplex full
     mls qos trust cos
     spanning-tree portfast
     spanning-tree bpduguard enable

!

Confused.

Regards,

Noob

[Meheretab Mengistu · Accepted solution]

Hi Noob,

The difference is in the purpose of the command itself. You do not need "sticky" option if you are going to configure the mac-address manually. The main reason you have the option is to 'stick' the dynamically learned mac-address to the port.

In some platforms (eg. in 3650 running (CAT3K_CAA-UNIVERSALK9-M), Version 03.07.01E ) you are not even allowed to run "sticky" with manually assigned MAC addresses.

HTH,
Meheretab

[RyanB · Accepted solution]

One thing I noticed with your configuration, port-security is not yet enabled.

You MUST enable port-security using the command: switchport port-security

interface GigabitEthernet0/0
 switchport mode access
 switchport port-security maximum 4
 switchport port-security violation restrict
 switchport port-security mac-address 0050.7966.6800
end

Switch#show port-security int g0/0
Port Security              : Disabled
Port Status                : Secure-down
Violation Mode             : Restrict
<truncated>

interface GigabitEthernet0/0
 switchport mode access
 switchport port-security maximum 4
 switchport port-security violation restrict
 switchport port-security mac-address 0050.7966.6800
 switchport port-security
end

Switch#show port-security int g0/0
Port Security              : Enabled
Port Status                : Secure-up
Violation Mode             : Restrict

I dont see any functional different between the two specifications of MAC addresses, however Cisco recommends against specifying a MAC address with the sticky command. I have also heard that with newer versions of IOS the option is removed, but I cant confirm first hand.

If at some point you decide to disable port-security sticky, all the manually configured and learned sticky mac-addresses will also be removed. Where as the other statically configured MAC address will remain.

[Julio E. Moisa · Accepted solution]

Hi

I think other members have provided great answers, basically:

Sticky method will learn the Host's MAC address automatically once any host is connected to the port. 

Static method you will assign the MAC address in order to say, just these MAC addresses are allowed to be connected to this port. 

I don't like to recommend the static method because it could generate a complex management. 

With sticky, I recommend use these commands:

switchport port-security aging type inactivity
switchport port-security aging time <time in minutes>

It is useful to refresh and remove the inactive MAC addresses. 

Hope it is useful

:-)

[SJ K]

Thank you all for replying.

Just a last question on the reason for enabling port securty

-  if we allow dynamic learning, it means we allow different kind of devices to be connected &

- we are just limiting the amount of devices that can be connected to that switchport.

Maybe i am not seeing the full picture, What good use would that be to limit the amount of devices that can be connected to a switch port ? I just need 1 rouge device to cause damage, isn't it ?

[RyanB]

The primary reason is to prevent rogue switches from allowing unauthorized access to your network or even STP problems resulting from that switch.

A common set up in the real world for end users is often to have a maximum of 2 permitted MAC addresses, 1 for the VoIP phone, and 1 for the PC end station piggy backing off the VoIP phone.

If someone brought in a simple switch and plugged it in in place of the VoIP phone, they can potentially allow access to different devices into the network (for example, personal laptops, which could have viruses or other malware which could impact users on your network).

By limiting the MAC addresses to 2, preferably manually configured to be the most secure, you can rest assured that only those 2 devices will be permitted to send frames. Although, this doesnt stop a user from SPOOFING a MAC address on their device to gain access.

[SJ K]

Hi Ryan,

All my access ports have bpdu guard, so rouge switch with STP is unlikely to cause damage.

Users sometimes have more then 2 device (phone + pc) connected,
and if they really want to get away , they can always connected to a router(with built-in switchports) ?

Regards,
Noob

[RyanB]

Yup, they can do that too.
This is where 802.1x can help.

[Julio E. Moisa]

Hi

That is correct, you will allow different kind of devices to be connected to the port until the maximum MAC address allowed is completed. For example if you set up maximum of 5 under a port, you can connect 5 different devices on that port, a 6th device could disable the port or just send a message to inform, it depends of the type of violation configured.