5.4Layer 2 security

Even if you harden L3 and above with firewalls and ACLs, an attacker who plugs a device into an internal-LAN switch port can carry out Layer 2 attacks such as MAC flooding, a rogue DHCP server, and ARP spoofing. Because L2 attacks occur "within the same segment," L3 controls cannot stop them. This section covers the three representative L2 security features you should enable on access switches, focusing on "which attack each one stops and by what mechanism."

5.4.1Port security

• Port security limits the number and identity of MAC addresses allowed on an access port. When the allowed count is exceeded or a disallowed MAC appears, it is handled as a "violation." The baseline config is switchport mode access → switchport port-security → switchport port-security maximum N (the maximum). The default maximum is 1.
• Allowed MACs can be registered manually (switchport port-security mac-address ADDRESS) or via sticky MAC (switchport port-security mac-address sticky), which dynamically learns the first MAC into the allow list and saves it to the running-config. This pins "the legitimate device currently connected" without manual entry.
• The violation action is chosen from three via switchport port-security violation. protect silently drops violating frames (no log or counter increment). restrict drops violating frames and sends an SNMP trap/Syslog and increments the counter. shutdown (the default) puts the port into an err-disabled state, shutting it down, and notifies; recovery requires shutdown then no shutdown, or errdisable recovery.