Port Security: Static Secure MAC Binding

Bundle lab

Troubleshoot a Layer-2 forwarding fault that breaks a user VLAN between access/distribution switches, then implement static secure MAC binding on the client-facing access port. You will restore end-to-end VLAN 20 reachability and enforce a single authorized MAC on the user port using port-security with violation restrict.

Learning objectives

• Diagnose and correct a trunk allow-list drift that prunes VLAN 20 from one uplink
• Align native VLANs across trunks and harden them (allowed list, native 999, nonegotiate)
• Configure static secure MAC binding on a host-facing access port and set maximum and violation restrict
• Verify secure address state and confirm port-security is not applied to trunks
• Explain how static binding differs from sticky learning

Troubleshooting focus

• CLIENT01 cannot ping 10.20.20.20 (or SRV01 cannot ping 10.20.20.10): Compare allowed VLANs on both ends of each trunk. VLAN 20 must appear on the DIST1–ACC1 and the DIST1–ACC2 trunk.; Confirm native VLAN alignment — both ends should use VLAN 999.; Confirm the host-facing access ports are in VLAN 20, up/up, and not err-disabled.; Check the STP state for VLAN 20 for unexpected blocking on the path.
• Port-security blocks the authorized device: verify the statically bound MAC matches CLIENT01's actual MAC, that maximum is 1 and violation is restrict (not shutdown), and that port-security is applied only to the access port, never a trunk.
• show port-security interface <interface> reports Port Security: Disabled even though the options are all configured: an interface accepts violation mode, sticky learning and maximum while the feature itself is off.