CCNA Port Security: Violation Protect vs Restrict

Bundle lab

Deploy and compare the two non-disabling port-security violation modes on host-facing access ports. Build a small Layer-2 topology with a trunk between two switches and same-VLAN hosts. Configure violation protect on one access port and restrict on another using deterministic sticky MAC entries. Validate baseline reachability, then observe the different behaviors: protect silently drops with no counter/logs; restrict drops and increments the violation counter.

Learning objectives

• Configure switchport port-security on host-facing access ports (maximum 1, sticky MAC, violation mode).
• Contrast violation protect vs restrict behavior and expected counters/logging.
• Verify port-security state and counters with show port-security and show port-security interface.
• Maintain correct Layer-2 design: access ports for hosts; 802.1Q trunk between switches carrying user VLANs.

Troubleshooting focus

• If hosts cannot ping in the baseline, confirm both access ports are in VLAN 20 and the inter-switch link is an 802.1Q trunk allowing VLAN 20.
• If protect mode shows a nonzero violation count, re-check the mode; protect should not increment the counter (restrict does).
• If restrict mode counter stays at 0 after testing, ensure test traffic was actually sent (ping from the host) and the sticky entry does not match the real host MAC.
• If a port goes err-disabled, verify you did not configure violation shutdown (this lab uses protect and restrict only).
• Never apply port-security on the trunk; it must remain a pure 802.1Q link.