How to Lock Down Switch Ports With Port Security and Storm Control

Step by step

1. Shut unused ports

   Every unused port is an open door. Disable them and move them to an unused VLAN.

   interface range gigabitEthernet 0/30-48
    switchport access vlan 999
    shutdown
   

2. Limit MAC addresses per port

   A desk normally needs one or two MACs (phone + PC). Limit it so a hidden switch cannot be plugged in.

   interface range gigabitEthernet 0/1-24
    switchport port-security
    switchport port-security maximum 2
   

3. Choose the violation action

   'restrict' drops traffic and logs; 'shutdown' disables the port until an admin re-enables it. Use shutdown in high-security areas.

   switchport port-security violation restrict
   

4. Use sticky learning for fixed devices

   For cameras and printers, let the switch learn and save the current MAC.

   switchport port-security mac-address sticky
   

5. Enable storm control

   Cap broadcast and multicast so one faulty device cannot flood the network.

   storm-control broadcast level 5
   storm-control multicast level 10
   

6. Protect against loops

   Combine with BPDU guard on edge ports (see the spanning-tree tutorial).

7. Monitor violations

   Send port-security and storm-control events to syslog and review them weekly.

   show port-security
   show storm-control
   

Commands are generic, industry-standard examples. Exact syntax and menu names vary by model and firmware; check your device's manual on the Documentation page.