lock a switch port to one device with port security

the lobby port nobody thinks about

every office has one. a wall jack in the lobby, the conference room, the break area, left active because unplugging it felt like more trouble than it was worth. it's just sitting there, live, waiting for anyone with an ethernet cable to walk up and join your network like they own the place. no badge check, no login prompt, nothing. that's the gap port security closes.

the idea is dead simple: a switch port should talk to the device that's supposed to be there, and nothing else. if some rando unplugs the receptionist's phone and plugs in a laptop instead, the port should notice and slam the door shut. that's exactly what these five lines do.

breaking down the command

interface gi0/5
 switchport port-security
 switchport port-security maximum 1
 switchport port-security mac-address sticky
 switchport port-security violation shutdown

interface gi0/5 just tells the switch which physical port you're configuring. this is the jack in the wall, the one thing you can actually point to and say "this is the one in the lobby."

switchport port-security turns the feature on for that port. without this line, none of the rest matters, the port is wide open no matter what else you type.

switchport port-security maximum 1 caps the number of mac addresses the port will ever learn at one. this is the whole point. one device, one port, no exceptions. if someone tries to hide a switch or hub behind that jack to sneak in extra devices, this line is what stops it.

switchport port-security mac-address sticky tells the switch to learn whatever mac address shows up first and lock it in permanently, saved to the running config like you typed it in yourself. you don't have to know the device's mac address ahead of time, the switch figures it out and remembers.

switchport port-security violation shutdown is the enforcement. if a second, unrecognized mac address ever shows up on that port, the switch doesn't just drop the traffic, it disables the port entirely. it goes err-disabled and stays that way until a human intervenes. loud, obvious, and impossible to ignore.

why "sticky" beats hardcoding

you could statically type in the exact mac address you expect on that port, but sticky is friendlier to actually maintain. plug in the legitimate device once, the switch learns it, done. no spreadsheet of mac addresses to keep updated, no typos. it's a one-time trust decision the switch remembers for you.

what actually happens when someone tries it

picture the scenario from the caption: someone unplugs the lobby phone and plugs in their own laptop hoping to get on the network. the switch sees a mac address that doesn't match what it learned, treats it as a violation, and shuts the port down instantly. no traffic gets through, not even a trickle. the port sits dead until someone with switch access notices and clears it with a shutdown/no shutdown cycle, ideally after figuring out why it tripped.

that's the part people undersell. this isn't a warning log buried in syslog that nobody reads for six weeks. it's an immediate, physical-feeling consequence. the jack just stops working. that's a feature, not a bug.

where this fits and where it doesn't

port security is perfect for predictable, single-device spots: phones, printers, kiosks, badge readers, that one desk in the lobby. it is not a replacement for real network access control on ports where legitimate devices rotate, like a conference room where different laptops plug in every day. for those, you want something smarter like 802.1x, or at minimum a higher maximum with monitoring instead of shutdown.

the takeaway

go audit your own switch ports before someone else finds the open ones for you. run show interfaces status to see which ports are up and unused, then ask yourself if any of them are sitting in a physically accessible spot with no protection. lobbies, hallways, unlocked conference rooms, anywhere a stranger could plausibly reach a jack unsupervised. lock those down with port security, set the violation action to shutdown so you actually notice when it trips, and check your switch logs periodically for err-disabled ports, because that log entry is the switch telling you someone just tried the door.