Open the lab
[ YOUR LAB FILE ]
Download the starting topology, then work through the lesson in SwitchLab.
- Save the .swlab file without renaming its extension.
- Open SwitchLab. Import and export controls currently require a desktop-width window. On a smaller screen, Tools → Fit brings the topology into view.
- Select Import Sandbox (folder icon), choose the downloaded file, and confirm the device and cable counts below.
- Select a device, then choose Open device on desktop or its name in the bottom bar on smaller screens. Select CLI for switches/routers or Desktop → Terminal for PCs. Enter
enableonly when the prompt ends in >. - Follow this page beside the simulator. Use a free account to export your work. Reimport the original download to restart; export any work you want to keep first.
Prerequisites
- Complete Ethernet MAC learning and VLAN access-port lessons.
Topology
3 devices · 2 links
Scenario
A fixed workstation uses a dedicated access port. Bind that port to the approved MAC and retain one-host access with restrict mode.
Objectives
- Verify the approved MAC-to-access-port association.
- Enforce port security while restoring legitimate host traffic.
CCNA blueprint
200-301 v1.1 objectives — this lab covers the following specific skills, not every subtopic in the domain.
- 5.7 — Configure and verify Layer 2 port-security controls.
Starting information
- PC1 connects to SW1 g0/1 with approved MAC 0011.2233.4455. PC2 on g0/2 is the delivery control. Both are in VLAN 10.
- Maximum secure MAC count is 1. Approved violation mode is restrict.
- The old/mismatched MAC 0011.2233.9999 is not authorized for PC1’s port. Keep port security enabled in the final configuration.
| Host | IPv4 address | Mask | Gateway |
|---|---|---|---|
| PC1 | 192.168.10.10 | 255.255.255.0 | None |
| PC2 | 192.168.10.20 | 255.255.255.0 | None |
| Device / port | Device / port |
|---|---|
| PC1 / eth0 | SW1 / g0/1 |
| PC2 / eth0 | SW1 / g0/2 |
Tasks
- Inspect PC1’s physical address with
ipconfig /all, then generate a ping to 192.168.10.20 and inspectshow port-security interface g0/1. - Apply the approved secure MAC, maximum count and violation mode on SW1 g0/1.
- Verify the exact secure MAC and enabled security state, then test PC1 → PC2 and PC2 → PC1.
- As a controlled negative test, temporarily replace the permitted secure MAC with 0011.2233.9999 and ping from PC1. Verify a security violation and failed delivery. Restore 0011.2233.4455 before the final export.
- Save/export and reload. Confirm the intended secure MAC remains configured and approved-host traffic still works.
Useful commands
show running-config interface g0/1
show port-security interface g0/1
copy running-config startup-configProgressive hints
Hint 1
Compare the PC’s actual MAC with the configured secure MAC; an unchanged IP address does not preserve hardware identity.
Hint 2
A security violation is distinct from an administratively shut port. Correct the authorization before recovering a shutdown-mode violation.
Hint 3
Remove the stale secure MAC, configure 0011.2233.4455 on g0/1, keep maximum 1 and the approved violation mode, then recover the interface if needed.
Verification
- SW1 g0/1 retains port security with the approved secure MAC and mode.
- PC1 and PC2 communicate after the repair and after export/reload.
- A mismatched authorized MAC prevents PC1’s required delivery.
Solution / walkthrough
Show Solution
Use enable only from a > prompt; if already at #, begin with configure terminal.
SW1
Correct the authorized device identity instead of disabling the protection. Recovery follows the MAC correction in the shutdown-mode scenario.
enable
configure terminal
interface g0/1
switchport mode access
switchport port-security maximum 1
switchport port-security mac-address 0011.2233.4455
switchport port-security violation restrict
switchport port-security
end
copy running-config startup-configRun every verification check above after the changes. A saved configuration alone does not prove packet delivery.