Cisco SG300 Port Security and Static Mac Filtering

 Posted on July 25, 2021  |  2 minutes  |  242 words

I’ve got a device attached to a Cisco SG300 switch that I don’t trust which is on a separate VLAN. As an exercise, using DAI(Dynamic ARP Inspection) is the preferred solution but I want to manually statically assign the IP and MAC to the port instead.

The Problem

Anyone that’s used an SG300 or similar product lines knows that the CLI they use isn’t a complete Cisco IOS like for like match. They differ in commands and behaviour. Which is why this makes a good learning experience. I’m going to show both doing it via the GUI and CLI.

The Solution

Before starting the steps, DHCP Snooping needs to be enabled. Make sure to setup trusted interfaces and backing up the bindings database. Next IP Source Guard enabled on the selected port and add the IP binding.

GUI:

  • Configure static MAC entry

    MAC Address Tables > Static Addresses > Add

    Status: Secure (NEEDS to be selected)

  • Enable protection on the Port(s)

    Port Management > Port Settings Protected Port: Enabled

  • Enable port security and on violation discard

    Security > Port Security

    Interface Status: Lock Learning Mode: Secure Permanent Action on Violation: Discard

CLI:

  • Enable protection on the Port(s)

    switchport protected-port

  • Keeps the current MAC address related to the port via the static secure tagged entry

    port security mode secure permanent

  • Enable port security and on violation discard

    port security discard

  • Configure static MAC entry

    mac address-table static H:H:H:H:H:H vlan <vlan-id> interface <gi2> secure

Networking 

See also