CloudLabBox
Try the free demo

CCNA lab 15 of 46

Port security with sticky MACs and violation modes

Lock three office ports to the devices that belong there with sticky and static secure MACs, trigger a real violation from a Linux host that changes its MAC address, and compare protect, restrict and shutdown before recovering the port.

Run this lab

It needs Lite: its 5 nodes are set to 5 vCPU and 4,608 MB in total. That fits the free demo too.

In your workspace: Shared, then CCNA 200-301 guided labs, then 15 - Port security with sticky MACs and violation modes

Try it free for 30 minutesRun it on Lite from £3 a day

The free demo needs no card and no email. Every lab plan includes every guided lab.

Level
Intermediate
Time
About 45 minutes
Nodes need
5 vCPU, 4,608 MB
Smallest plan
Lite

The scenario

Ashby Dental's reception switch (S1) has a free port at a hot desk, and last week a visitor plugged in their own laptop and a pocket switch. The practice wants each port tied to its own device: the reception PC (PC1), the accounts PC (PC2) and the hot-desk laptop (H1), which the IT supplier registers by MAC address.

DevicePortAddressPort security policy
R1Gi0/0 (uplink, S1 Gi0/0)10.15.10.1/24none (uplink)
PC1S1 Gi0/110.15.10.11/241 MAC, sticky, shutdown
PC2S1 Gi0/210.15.10.12/241 MAC, sticky, protect
H1S1 Gi0/310.15.10.13/24, MAC 02:00:00:00:15:131 MAC, static 0200.0000.1513, restrict

Topology: R1 Gi0/0 — S1 Gi0/0 · S1 Gi0/1, Gi0/2, Gi0/3 — PC1, PC2, H1.

What you’ll practise

  • Explain the threats port security addresses: MAC flooding and unauthorised devices
  • Configure maximum addresses, sticky learning and static secure MACs
  • Choose between the protect, restrict and shutdown violation modes
  • Trigger and diagnose a violation with show port-security and the logs
  • Recover an err-disabled port by hand and with errdisable recovery

The tasks

  1. Get the hot-desk laptop online
  2. Lock reception with sticky learning
  3. Register the hot desk with a static secure MAC
  4. Compare the violation modes
  5. Trigger a violation
  6. Recover the port

The Lab Tasks pane has the scenario, these tasks, the checks to run, hints and the full solution.

Topology and devices

The network as it opens in EVE-NG, drawn from the lab’s own canvas, and the image each node runs.

Topology of Port security with sticky MACs and violation modes5 nodes, 4 links. Every link is listed as text below the diagram.R1S1PC1PC2H1Gi0/0Gi0/0Gi0/2eth0Gi0/1eth0Gi0/3eth0
5 nodes, with the interface names each link uses. On a narrow screen, scroll the diagram sideways.
Every link, as text
  • R1 Gi0/0 to S1 Gi0/0
  • S1 Gi0/1 to PC1 eth0
  • S1 Gi0/2 to PC2 eth0
  • S1 Gi0/3 to H1 eth0
Nodes in Port security with sticky MACs and violation modes, with the image each runs and the vCPU and RAM it’s set to
NodeDeviceImage in Add NodeSet to
R1Cisco IOSvvios-adventerprisek9-m.SPA.159-3.M61 vCPU, 1,024 MB
S1Cisco IOSvL2viosl2-adventerprisek9-m.ssa.high_iron_202009291 vCPU, 1,024 MB
PC1VPCS hostBuilt in to EVE-NGCounted as 1 vCPU, 1,024 MB
PC2VPCS hostBuilt in to EVE-NGCounted as 1 vCPU, 1,024 MB
H1Alpine Linuxclbalpinebase-alpine-base-3-20-31 vCPU, 512 MB

How to open this lab

  1. Sign in to your workspace at lab.cloudlabbox.com.

  2. In File Manager, open Shared, then the folder CCNA 200-301 guided labs.

  3. Open 15 - Port security with sticky MACs and violation modes and start its nodes, then open Lab Tasks for the scenario and the steps.

The lab is read-only. You can start the nodes and configure the devices, but changes to the topology can’t be saved. To change it, rebuild it in your own folder.

More CCNA labs

All CCNA labs

Related labs in other courses

CloudLabBox is independent of Cisco. The lab follows exam topics and isn’t vendor training material; vendor names identify the exams and the images in the workspace.