CCNA Port Security: Maximum Secure MACs on Access Ports

Bundle lab

Deploy and verify port security maximum settings on host-facing access ports in a pure Layer-2 campus with two access switches uplinked to a distribution switch. You will raise the allowed secure MAC count to 2 on each user port to support a PC and a potential downstream device (e.g., a dock), then verify with show commands. No Layer-3, SVIs, or routing are used; focus purely on access VLANs, trunks, and the port-security maximum behavior.

Learning objectives

• Configure switchport port-security with a specific maximum (2) on host-facing access ports
• Verify maximum and current secure MAC counts with show port-security interface
• Differentiate what traffic is permitted vs. blocked when the secure MAC count exceeds the maximum
• Avoid misconfiguration by never applying port-security on trunks

Troubleshooting focus

• A host port left in the wrong VLAN breaks same-VLAN pings.
• Pings fail only between the two access switches: VLAN 20 is missing from a trunk allow-list. Align the allowed list on both ends of each distribution link.
• A trunk reports a native VLAN mismatch: both ends must use VLAN 999 as native. A mismatch draws CDP/LLDP warnings and makes some control-plane behaviour inconsistent.
• Port-security only takes on a static access port, and belongs only on host-facing ports — remove it from any trunk configured in error.
• show port-security interface Ethernet0/1 reports Port Security: Disabled even though the maximum and violation lines are present: the interface accepts those options with the feature switched off.
• A legitimate second device behind a port triggers a violation: the maximum is still 1. show port-security interface Ethernet0/1 must report Maximum 2 — the default violation mode is shutdown.