Security Fundamentals Build ~6 min

Harden an access port (Port Security + IP Source Guard)

Fa0/3 is a user PC port. Lock it to 2 MAC addresses max, use sticky learning, violation restrict. Then add IP Source Guard so only traffic whose source IP+MAC matches the DHCP snooping binding is allowed. DHCP snooping must be on first (IPSG reads its binding table).

Topology

SW1

Objectives

○DHCP snooping enabled globally
○Port security enabled on Fa0/3
○Fa0/3 max 2 MAC addresses
○Fa0/3 sticky MAC learning enabled
○IP Source Guard enabled on Fa0/3

Hints

Hint 1, order matters

IPSG doesn't invent bindings. It reads them from DHCP snooping's binding table. Turn snooping on first, then the port-level lockdown.

Hint 2, sticky vs. static

Sticky = the switch learns the first N MACs it sees and pins them into the running-config. Static = you type each allowed MAC yourself. Sticky is the pragmatic choice for user ports.

Hint 3, full sequence

enable
configure terminal
 ip dhcp snooping
 interface fa0/3
  switchport mode access
  switchport port-security
  switchport port-security maximum 2
  switchport port-security mac-address sticky
  ip verify source
  end

← Previous task

Secure VTY lines for SSH only

Security Fundamentals · ~6 min

Next task →

Write an extended ACL

Security Fundamentals · ~7 min

Stuck on a lab, or not sure what to practice next?

Talk it through with a mentor on a free 20-minute call. We look at your lab, your exam date and your weak spots, and you leave with a plan.

Book free session

Cisco Mentorship

CompTIA Foundation

Firewall Security

Short Courses

More

CCNA v1.1

CCNA v2.0

CCNA Automation

CCNP

Network+

NSE 4

Lab Tasks

Videos

Packet Tracer Labs

Simulators

Harden an access port (Port Security + IP Source Guard)

Stuck on a lab, or not sure what to practice next?