CCNA Port Security 2: Sticky Secure MAC Learning

Bundle lab

Two access-layer switches have a VLAN 20 connectivity problem: users in one wiring closet cannot reach users in the other. Diagnose and repair the issue, then deploy sticky secure MAC learning on the host-facing access ports so each port dynamically learns and persists its connected host's MAC. Verify sticky entries in show commands and confirm same-VLAN host connectivity end-to-end.

Learning objectives

• Identify and fix a trunk allow-list drift that prevents a user VLAN from traversing between switches
• Configure port security on host-facing access ports so each one automatically learns and locks onto its connected device’s MAC address (sticky learning)
• Set a secure address maximum per port and verify sticky learning in show port-security and running-config
• Validate same-VLAN host connectivity across an 802.1Q trunk

Troubleshooting focus

• ping 10.20.20.20 from CLIENT-A fails: Check the trunk on both ends for VLAN 20 in the allowed list with show interfaces trunk. Fix any drift.; Confirm the native VLAN on the trunk is 999 on both ends.; Ensure the client-facing ports are access ports in VLAN 20, not the default VLAN 1 or another VLAN.
• show port-security address lists no sticky MAC for the port: Make sure port-security is enabled on the interface and that maximum is at least 1.; Generate traffic with a ping so the port learns the MAC.; If violation mode is shutdown and a mismatch occurred, the port may be err-disabled. Clear it with shut/no shut and correct the cause.
• A second device's frames are dropped on a secured port: with sticky learning and maximum 1 that is the intended behaviour. Check show port-security interface for the violation counters.
• show port-security interface <interface> does not report Port Security: Enabled even though the sticky, violation and maximum lines are present: an interface accepts those options while the feature itself is off.