Port Security Setup

Cisco Packet Tracer

Hello again,

Today, I’m working on a port security demonstration in Cisco Packet Tracer.

Ready to follow along? Boot it up and try this with me. It’s simple, fun, and a great way to understand how switches handle unauthorized devices. I’ll walk you through everything step-by-step.

Seto Kaiba from Yu-Gi-Oh!

Step 1: Create the Network Topology

Let’s start with a basic topology — three PCs and one switch.

Setup:

• Connect all three PCs using copper straight-through cables
• Assign the following switch ports:
• PC0 → FastEthernet0/1
• PC1 → FastEthernet0/2
• PC2 → FastEthernet0/3

You can rename your PCs if you want, but I usually stick with the default names.

My screenshot :D

Step 2: Assign IP Addresses

Next, assign each PC an IP address.

Go to each PC and open Desktop → IP Configuration, then enter the following:

• PC0: 192.168.1.10
• PC1: 192.168.1.20
• PC2: 192.168.1.30

Packet Tracer will automatically fill in the subnet mask when you enter the IP address.

We’re doing this so we can ping between the PCs and let the switch learn their MAC and IP associations. This will matter later when PC2 “attacks” by using PC0’s port.

Step 3: Configure Port Security on the Switch

Now that your devices are connected and have IP addresses, it’s time to move into the Switch CLI and set up port security.

Enter configuration mode

Switch> enable
Switch# configure terminal

Assign access mode and enable port security

We’ll configure the first two ports (for PC0 and PC1) as access ports and apply port security rules.

Switch(config)# interface range fa0/1 - 2
Switch(config-if-range)# switchport mode access
Switch(config-if-range)# switchport port-security
Switch(config-if-range)# switchport port-security maximum 1
Switch(config-if-range)# switchport port-security violation shutdown
Switch(config-if-range)# switchport port-security mac-address sticky
Switch(config-if-range)# exit

This configuration means:

• Only one device (MAC address) can connect per port
• If another device tries to connect, the port will shut down
• The switch will “remember” the connected device’s MAC address automatically

Step 4: Testing the Setup

Alright — hard part’s over!

Cisco Packet Tracer doesn’t allow two PCs to use the same IP address. So, instead of spoofing the IP, we’ll test security by physically swapping PCs on the same port.

Here’s how to do it:

Make sure PC0 and PC1 can ping each other successfully.

(This ensures the switch learns both MAC addresses.)

1. Unplug PC0 from FastEthernet0/1.
2. Plug PC2 into that same port (FastEthernet0/1).
3. Try to ping PC1 from PC2.

When you do this, the switch will detect a different MAC address on a port that’s restricted to one device — this triggers a security violation.

You’ll notice:

• The port light turns red in Packet Tracer
• PC2 can no longer communicate
• The switch logs a security message

My screenshot :D

Step 5: Checking the Port Status

Go back to the Switch CLI and run these commands to see the violation details:

Switch# show port-security
Switch# show port-security interface fa0/1

Make sure you’re in enable mode, or these commands won’t work.

You’ll see a message similar to:

%PORT_SECURITY-2-PSECURE_VIOLATION: Security violation occurred
%PORT_SECURITY-2-PSECURE_SHUTDOWN: Interface FastEthernet0/1 shut down

At this point, your configuration successfully prevented an unauthorized device from connecting.

Step 6: (Optional) Re-enable the Port

If you want to bring the port back online, use these commands:

Switch# configure terminal
Switch(config)# interface fa0/1
Switch(config-if)# shutdown
Switch(config-if)# no shutdown
Switch(config-if)# exit

This will reset the interface so you can reconnect the original PC.

Real-World Example: Why Port Security Matters

Imagine you work in an office where every employee has their own computer connected to the company network through a wall port.

One day, someone brings in their personal laptop and plugs it into that same network port to “just check their email.” At first glance, that might seem harmless — but here’s what could go wrong:

• The personal laptop could be infected with malware.
• It might try to access files or servers that only company devices should reach.
• It could even run a network scanning tool, intentionally or accidentally exposing sensitive data.

With port security enabled, the switch immediately detects that a different device (with a new MAC address) has connected to that port. Depending on how it’s configured, the switch can:

• Shut down the port completely
• Send an alert to the network administrator
• Or restrict the new device until it’s verified

This helps keep unauthorized or unknown devices from ever joining the internal network — which is exactly what you simulated in Packet Tracer when you swapped PCs.

In real environments like schools, hospitals, and offices, this feature is essential for keeping networks secure and minimizing human error.

Conclusion

And that’s it!

You’ve just demonstrated basic port security in Cisco Packet Tracer — one of the simplest but most effective ways to prevent unauthorized devices from joining your network.

When a new device tries to connect where it shouldn’t, the switch automatically disables the port to protect your network.

This setup is great for anyone learning how real-world switches handle access control and network security.

Thank you ChatGPT for helping to explain things a lot clearer.