CCNA Port-Sec 9: Multi-Port Sticky Restrict Policy

Bundle lab

Advanced CCNA switchport port-security rollout on multiple access ports across two Layer-2 switches with a trunk. You will standardize a consistent edge policy (sticky MAC learning, maximum 1, violation restrict) on all host-facing access ports while leaving the uplink trunk exempt from port-security. Includes a realistic drift on the trunk allow-list and VLAN database to fix before validating end-to-end user VLAN transport. Pure Layer-2: no SVIs or routing.

Learning objectives

• Deploy a consistent port-security policy (maximum 1, sticky MAC, violation restrict) on multiple host-facing access ports
• Deliberately exclude the trunk/uplink from port-security and explain why
• Verify secure MAC learning and per-interface state with show port-security and show port-security interface
• Align VLAN databases and trunk allow-lists to ensure same-VLAN hosts can communicate across switches
• Differentiate violation restrict behavior from protect/shutdown using counters without errdisabling the port
• Apply edge-hardening extras (portfast, bpduguard) safely on access ports only

Troubleshooting focus

• Identify and fix a missing VLAN from a trunk allow-list that breaks same-VLAN reachability across switches
• Resolve host ports assigned to the wrong VLAN causing silent isolation
• Validate native VLAN alignment to avoid control-plane warnings and L2 anomalies
• Use show port-security, address tables, and violation counters to confirm policy operation