Port Security: Voice + Data on One Access Port

Bundle lab

Harden a real desk port that carries both data (PC) and voice (IP phone) using switchport voice vlan and access vlan on a single access port. Apply port security with a maximum that accounts for two MAC addresses (phone + PC) so a third device is restricted. A deliberate trunk allow-list drift on the inter-switch link initially blocks the Voice VLAN; learners must repair the trunk and then verify port-security state on the desk port.

Learning objectives

• Create and name User and Voice VLANs on L2 switches (no Layer-3).
• Configure an access port that carries both the data VLAN (PC) and the voice VLAN (IP phone) on the same physical port.
• Enable port security on a host-facing access port with a maximum of 2 MAC addresses, choosing a violation response that drops and counts frames from an additional device without disabling the port.
• Harden the trunk: native VLAN 999, allowed VLANs, and nonegotiate.
• Verify secured addresses and maximum on the desk port using show port-security interface.
• Fix a trunk allow-list drift that omits the Voice VLAN and confirm restoration.

Troubleshooting focus

• CDP/STP warnings appear and broadcast behaviour is odd: the trunk native VLANs disagree. Ensure both ends of Ethernet0/3 use native VLAN 999.
• A VLAN has no end-to-end transport between the switches: compare the trunk's allowed-VLAN list on each end with show interfaces trunk against every VLAN actually in use, and add any that is missing.
• CLIENT-A cannot ping CLIENT-B: one of the host ports is in the wrong VLAN. Check show vlan brief and the access port configuration.
• show port-security lists the trunk among the controlled interfaces: remove port security there and apply it only on the host-facing desk port.
• A third MAC on the desk port is dropped but the port stays up: that is the configured behaviour. Frames are dropped, counters increment and syslog/traps may fire. Confirm with show port-security interface.
• show port-security interface <interface> reports Port Security: Disabled although violation mode, sticky learning and maximum are all set: the interface accepts those options while the feature is off. Add the command that enables it, or the grading check fails.