What does port security "sticky" MAC actually do, and what happens on violation?
I want each access port locked to the first device plugged in. Does sticky learning survive a reboot, and what are the violation modes really doing?
1 Answer
switchport port-security mac-address sticky learns the first MAC(s) dynamically and writes them into the running config — so after copy run start they survive reboots, giving you plug-and-lock without typing MACs by hand. On a violation (an unlisted MAC arrives) the three modes differ in noise: shutdown (default) err-disables the whole port — hard stop, needs shutdown/no shutdown (or errdisable recovery) to restore; restrict drops the offender's frames, increments the violation counter, and logs/SNMP-traps; protect silently drops — no counter, no log, which makes it the mode you'll regret during troubleshooting. Practical recipe: maximum 2 (PC + phone), sticky, restrict or shutdown depending on how strict the site is.