Security Fundamentals Build ~6 min

Harden an access port (Port Security + IP Source Guard)

Fa0/3 is a user PC port. Lock it to 2 MAC addresses max, use sticky learning, violation restrict. Then add IP Source Guard so only traffic whose source IP+MAC matches the DHCP snooping binding is allowed. DHCP snooping must be on first (IPSG reads its binding table).

SW1

Objectives

○DHCP snooping enabled globally
○Port security enabled on Fa0/3
○Fa0/3 max 2 MAC addresses
○Fa0/3 sticky MAC learning enabled
○IP Source Guard enabled on Fa0/3

Hint

Full sequence

enable
configure terminal
 ip dhcp snooping
 interface fa0/3
  switchport mode access
  switchport port-security
  switchport port-security maximum 2
  switchport port-security mac-address sticky
  ip verify source
  end

← Previous task

Secure VTY lines for SSH only

Security Fundamentals · ~6 min

Next task →

Write an extended ACL

Security Fundamentals · ~7 min