CCNA Capstone: Port Security Troubleshooting

Bundle lab

Advanced CCNA port-security troubleshooting on a pure Layer-2 design. Two access switches linked by an 802.1Q trunk carry a Users VLAN across closets. Three Alpine Linux hosts are pre-addressed. The lab is intentionally shipped with multiple classic faults: one access port is err-disabled due to a prior port-security shutdown, one user-facing port lacks port-security altogether, another has the wrong violation mode and an overly restrictive maximum, and one port has an incorrect static secure-MAC configured. Your job is to diagnose using show commands, restore connectivity, and implement the intended security posture with sticky MACs, the correct maximum, the proper violation mode, and errdisable auto-recovery—without placing port-security on the trunk.

Learning objectives

• Diagnose port-security states and violations with show port-security and show port-security interface
• Recover an err-disabled port caused by a psecure violation and enable errdisable auto-recovery
• Correct violation mode drift (protect vs restrict vs shutdown) to the stated policy
• Adjust a too-low maximum secure MAC count to meet port intent
• Enable sticky MAC learning on host-facing access ports and avoid applying port-security to trunks
• Remove an incorrect static secure-MAC binding and convert to a supported policy

Troubleshooting focus

• Identify which interface is err-disabled and why
• Differentiate between violation protect, restrict, and shutdown behavior
• Spot ports that lack port-security entirely
• Locate a too-low maximum secure MAC policy
• Find and remove a wrong static secure-MAC binding