By Arjun Kumar, Senior Trainer, Systech Group 15+ years in Network Security and Cloud Architecture · Updated October 2026.
9 min read
In short
To secure a Cisco switch, you need to do more than configure access ports and trunk ports. Use port security to control which devices can connect, DHCP snooping to block fake DHCP servers, and ARP inspection to prevent fake address details. Enable BPDU Guard to protect against unwanted switches, turn off unused ports, and use SSH for secure access. Always check your settings and test them to make sure the network works safely.
Table of Contents
Introduction
Configuring access ports for end devices and trunk ports between switches is an important step in building a Cisco network. However, these configurations alone do not protect the network from unauthorized devices, fake DHCP servers, ARP spoofing, network loops or unauthorized management access.
For example, an office may have correctly configured VLANs and trunk links, but an unauthorized device could still connect to an unused switch port. A malicious device might also attempt to provide false IP settings or impersonate another device on the local network.
To reduce these risks, network administrators should apply additional security controls to access ports, trunk links, management interfaces and unused ports. These controls should be tested and monitored instead of being enabled without checking how the network works.
If you are building your networking fundamentals, the CCNA course in Chennai provides a relevant learning path for understanding switching, VLANs, network access and security concepts.
This guide explains the main Cisco switch security configurations, why they matter, how to configure them on supported Cisco IOS switches, and how to verify that they are working correctly.
Why is switch security important after configuring access and trunk ports?
A switch connects devices inside a local area network (LAN). It forwards Ethernet frames based on MAC addresses and uses VLANs to separate network traffic.
Access ports normally connect end devices such as computers, printers and IP phones. Trunk ports carry traffic for multiple VLANs between compatible network devices.
These settings control how traffic enters and moves through the network. They do not automatically stop every attack.
Consider the following risks.
Cisco documents these controls as part of a layered approach to protecting switched networks. Their availability and exact configuration depend on the switch model, software version and network design.
Configure port security on access ports
Port security limits which source MAC addresses can use a switch port. It can help prevent unauthorized devices from using an access port and reduce the risk of MAC address flooding.
For example, suppose a switch port connects to one employee’s desktop computer. If someone disconnects that computer and connects an unauthorized device, port security can detect a MAC address violation.
Cisco port security configuration
The following example is for a Cisco IOS switch using interface GigabitEthernet1/0/1.
configure terminal
interface GigabitEthernet1/0/1
switchport mode access
switchport port-security
switchport port-security maximum 2
switchport port-security mac-address sticky
switchport port-security violation restrict
end
What these commands do:
- switchport mode access configures the interface as an access port.
- switchport port-security enables port security.
- maximum 2 permits up to two secure MAC addresses.
- mac-address sticky allows the switch to learn MAC addresses and add them to the running configuration.
- violation restrict drops traffic from violating MAC addresses and records the violation, with supported logging or counter behaviour.
Important: The maximum of two is an example, not a universal recommendation. A port connecting to a desktop and an IP phone may need more than one address, while a single-device port may need only one. Check the actual topology before applying a limit.
Sticky MAC learning also does not automatically mean the learned addresses are permanently saved. Save the running configuration if you intend to retain the configuration after a reboot.
How to verify port security
show port-security
show port-security interface GigabitEthernet1/0/1
show port-security address
show running-config interface GigabitEthernet1/0/1
Check the maximum allowed addresses, secure MAC address entries, violation count and interface status.
Which violation mode should you use?
The best mode depends on how quickly the administrator needs to detect and respond to violations. Cisco documents the supported modes and platform-specific behaviour in its switch security guidance.
Disable unused switch ports
Unused switch ports can become an easy entry point if someone connects an unauthorized computer, access point or other network device.
The simple and effective approach is to shut down unused interfaces and, where appropriate, assign them to an unused VLAN that does not provide access to production resources.
Example configuration
configure terminal
vlan 999
name UNUSED_PORTS
!
interface range GigabitEthernet1/0/20-24
switchport mode access
switchport access vlan 999
shutdown
end
This example reserves ports 20 through 24 for unused devices. Replace the interface range and VLAN ID with values appropriate for your network.
Do not move active ports into the unused VLAN. Check the interface description, connected device and switch configuration before making changes.
Why is this important?
Shutting down unused interfaces reduces the number of available connection points. The unused VLAN provides an additional layer of separation if an interface is accidentally enabled later.
Verify the result with:
show interfaces status
show vlan brief
show running-config interface GigabitEthernet1/0/20
Enable DHCP snooping to block rogue DHCP servers
DHCP automatically assigns IP addresses, subnet masks, default gateways and other network settings to clients.
A rogue DHCP server can send false settings to clients. For example, it might provide an incorrect gateway or DNS server, causing connection problems or allowing traffic to be redirected.
DHCP snooping examines DHCP messages and allows server-originated messages only through interfaces configured as trusted. Client-facing interfaces should normally remain untrusted.
Cisco also uses the DHCP snooping binding database as an input for features such as Dynamic ARP Inspection and IP Source Guard.
Example DHCP snooping configuration
Assume VLAN 10 is the user VLAN and GigabitEthernet1/0/48 is the uplink toward the legitimate DHCP server or the network path through which its DHCP messages arrive.
configure terminal
ip dhcp snooping
ip dhcp snooping vlan 10
!
interface GigabitEthernet1/0/48
ip dhcp snooping trust
end
Keep end-device ports untrusted. Trust only interfaces that genuinely need to receive legitimate DHCP server messages.
Do not blindly trust every trunk port. A trunk carrying multiple VLANs can introduce DHCP traffic from several parts of the network. The trust decision must match the actual topology and DHCP-server path.
Verification commands
show ip dhcp snooping
show ip dhcp snooping binding
show ip dhcp snooping statistics
Check whether snooping is enabled for the correct VLANs, whether trusted interfaces are correct, and whether clients are receiving valid leases.
If clients stop receiving IP addresses after enabling DHCP snooping, inspect the trusted path, VLAN membership and DHCP relay or server arrangement before changing the configuration.
Enable Dynamic ARP Inspection (DAI)
ARP, or Address Resolution Protocol, helps devices discover the MAC address associated with an IPv4 address on a local network.
In an ARP spoofing attack, a malicious device sends false ARP messages to associate its MAC address with another device’s IP address. This can allow traffic to be intercepted or disrupted.
Dynamic ARP Inspection checks ARP messages against trusted IP-to-MAC bindings. In a typical DHCP-based network, it uses information learned through DHCP snooping.
Example DAI configuration
For VLAN 10:
configure terminal
ip arp inspection vlan 10
end
This is only the VLAN-level enabling step. Confirm that the DHCP snooping binding database is populated and that legitimate devices are represented correctly.
Trusted interfaces, static IP devices and special network designs may require additional configuration. Do not mark an interface as trusted without understanding which ARP traffic can enter through it.
Verification commands
show ip arp inspection
show ip arp inspection vlan 10
show ip arp inspection statistics
show ip dhcp snooping binding
These commands help you review the enabled VLANs, inspection status, packet statistics and learned bindings.
For detailed platform-specific behaviour, refer to Cisco’s DAI and IP Source Guard troubleshooting documentation.
Configure IP Source Guard where appropriate
IP Source Guard helps stop a host from sending IP traffic using an unauthorized source IP address on a supported Layer 2 interface.
For example, a computer assigned one IP address might attempt to use another device’s IP address. IP Source Guard can filter traffic against DHCP snooping bindings or manually configured source bindings.
Example configuration
On a supported Cisco IOS switch, for a client-facing interface in a DHCP-enabled VLAN:
configure terminal
interface GigabitEthernet1/0/1
ip verify source
end
This example assumes that the platform supports the command and that the required DHCP snooping and binding information is correctly configured.
Before enabling it, check the impact on static-IP devices, printers, servers and other endpoints that do not obtain their addresses through DHCP. Static bindings or a different supported configuration may be required.
Verification
show ip verify source
show ip dhcp snooping binding
IP Source Guard is most useful when its bindings match the actual devices and addressing plan. Incorrect bindings can block legitimate traffic.
Enable PortFast and BPDU Guard on end-device ports
Spanning Tree Protocol (STP) prevents Layer 2 switching loops. A loop can cause repeated frame forwarding, excessive broadcast traffic and network disruption.
PortFast allows an appropriate end-device port to move quickly into the forwarding state. BPDU Guard protects that port by placing it into an error-disabled state if it receives a Bridge Protocol Data Unit (BPDU).
This is useful because a normal PC-facing port should not unexpectedly receive BPDUs from an unauthorized switch or bridge. Cisco recommends BPDU Guard for suitable PortFast-enabled access ports.
Example configuration
configure terminal
interface range GigabitEthernet1/0/1-24
spanning-tree portfast
spanning-tree bpduguard enable
end
Use this only for genuine end-device ports. Do not apply this blanket interface range to switch-to-switch trunks. A port that receives a BPDU may be shut down, which can interrupt connectivity.
If an interface becomes error-disabled, investigate the cause before restoring it.
Verification commands
show spanning-tree summary
show spanning-tree interface GigabitEthernet1/0/1 detail
show interfaces status
A BPDU Guard shutdown is a protective response, not proof that the underlying problem has been fixed.
Secure trunk ports and VLAN configuration
Trunk ports carry traffic for multiple VLANs. Incorrect trunk configuration can expose VLANs to devices or paths that should not have access to them.
Administrators should check which VLANs are allowed on each trunk, whether the native VLAN is consistent across both ends, and whether trunk negotiation is needed.
Example trunk configuration
configure terminal
interface GigabitEthernet1/0/48
switchport mode trunk
switchport trunk allowed vlan 10,20,30,99
switchport trunk native vlan 999
end
This is an example for a platform that supports these commands. VLAN 999 must exist and be reserved appropriately, and both ends of the trunk must agree on the native VLAN. The allowed VLAN list must include every VLAN required by the connected devices and network services.
A native VLAN change is not a cosmetic security setting. An incorrect change can interrupt traffic or create a VLAN mismatch.
What should administrators check?
- Allow only the VLANs required on the trunk.
- Avoid carrying user traffic on the management VLAN.
- Ensure both ends of the trunk have matching native VLAN settings.
- Disable unused interfaces rather than leaving them available.
- Do not turn a required switch-to-switch link into an access port without checking its role.
Verification commands
show interfaces trunk
show interfaces GigabitEthernet1/0/48 switchport
show vlan brief
Cisco’s spanning-tree troubleshooting guidance also recommends keeping management traffic separate and planning predictable spanning-tree root placement.
Secure switch management access with SSH
Network administrators often manage switches through a command-line interface. If management access is poorly protected, an unauthorized user may be able to change VLANs, shut down interfaces or modify security settings.
Use SSH rather than Telnet for remote command-line access because SSH encrypts the management session. Where supported, use centralized authentication, authorization and accounting (AAA), restrict management access to approved addresses, and keep management interfaces on a dedicated management network.
Example Cisco IOS SSH configuration
The following is a starting example, not a complete production access policy.
configure terminal
hostname SW-ACCESS-01
ip domain-name example.local
username netadmin privilege 15 secret REPLACE_WITH_STRONG_SECRET
crypto key generate rsa modulus 2048
ip ssh version 2
!
line vty 0 15
login local
transport input ssh
end
Replace the example hostname, domain and credential with approved values. RSA key-generation syntax and key-size support vary by IOS release and platform.
This configuration enables local SSH authentication on the specified virtual terminal lines. It does not, by itself, restrict which source addresses may connect. A production deployment should also implement a management ACL or other supported access control and consider AAA integration.
Do not lock yourself out of a remotely managed switch. Test access from an authorized session and retain a safe recovery path before removing existing management methods.
Verification commands
show ip ssh
show users
show running-config | section line vty
show access-lists
Confirm that SSH works, Telnet is not accepted on the configured VTY lines, and only approved management sources can connect.
Protect passwords, management services and configuration files
Switch security involves more than access ports. The management plane should also be protected from unauthorized access and unnecessary services.
Recommended practices include:
- Use strong, unique administrator credentials and avoid shared accounts where individual accounts are practical.
- Prefer centralized AAA authentication when the network supports it.
- Restrict management access to approved hosts and networks.
- Use secure management protocols and disable unused management services where supported.
- Limit SNMP access, use SNMPv3 where supported, and avoid exposing read-write community strings.
- Send system logs to a protected logging server and monitor authentication failures, port-security violations and interface shutdowns.
- Back up switch configurations securely and restrict access to backup files.
- Keep switch software updated using the vendor’s supported release and change-management process.
A useful baseline is to review the switch’s management configuration regularly rather than waiting for a security incident.
Apply storm control and monitor unusual traffic
A malfunctioning device or malicious endpoint may send excessive broadcast, multicast or other traffic. On supported switches, storm control can limit specified traffic types to help reduce the impact on the LAN.
The threshold must be selected carefully. A threshold that is too low can drop legitimate traffic, while a threshold that is too high may provide little protection.
Administrators should also monitor interface counters, CPU usage, logs, spanning-tree changes and security-event counters. Storm control is not a replacement for diagnosing the cause of abnormal traffic.
Test the security configuration before production use
A configuration is not complete just because the switch accepts the commands. The administrator must verify that legitimate devices still work and that the intended security control is active.
Use a lab or approved maintenance window to test changes.
Securing a small office Cisco switch
Consider an office with the following network:
- VLAN 10: Employee computers
- VLAN 20: Servers
- VLAN 30: Guest devices
- VLAN 99: Network management
- VLAN 999: Reserved unused-port and native-VLAN designation, subject to the network design
The access switch connects employee computers on access ports and carries the required VLANs over a trunk to the distribution switch.
A sensible security plan would be to:
- Apply port security to suitable employee access ports.
- Shut down unused interfaces.
- Enable DHCP snooping for the VLANs that use DHCP.
- Trust only the verified DHCP server path.
- Enable DAI for VLANs where valid bindings and platform support are available.
- Apply IP Source Guard where the addressing model supports it.
- Enable PortFast and BPDU Guard on end-device ports.
- Limit trunk VLANs and check native VLAN consistency.
- Restrict switch management to SSH and approved management sources.
- Verify logs, counters and legitimate client connectivity after each change.
The correct configuration depends on the actual network. A switch carrying voice, wireless, server, static-IP or redundant links may need additional controls and exceptions. Apply each security feature based on the topology instead of copying a single configuration across every interface.
Common Cisco switch security mistakes to avoid
Enabling DHCP snooping without checking trusted interfaces
If the genuine DHCP server’s traffic arrives through an untrusted path, clients may fail to obtain addresses. Verify the path and VLAN scope first.
Enabling DAI without checking bindings
Static-IP devices or missing DHCP bindings can cause legitimate ARP traffic to be rejected. Review the binding database and configure supported exceptions where needed.
Applying BPDU Guard to switch trunks
A trunk may receive BPDUs during normal operation. Applying BPDU Guard indiscriminately can shut down the link and interrupt connectivity.
Using the same port-security limit everywhere
An interface connected to a single PC may need a different MAC limit from a port connected to an IP phone and a computer. Set limits based on the devices and topology.
Trusting every trunk interface
A trunk is not automatically trustworthy for DHCP or ARP traffic. Apply trust only after understanding the connected device and traffic path.
Making changes without saving or documenting them
After testing, save approved configuration changes and maintain a backup. Document the reason for each security setting and the steps required to recover from a blocked interface.
Not sure which route fits you?
Tell us your stream and what you are hoping for, and we will tell you honestly which option suits.
Get course detailsHow Cisco switch security supports cybersecurity
Switch security is an important part of network defence because it controls how devices connect and exchange traffic inside the LAN. However, it does not replace firewalls, endpoint protection, identity controls, monitoring or incident response.
For example, port security can limit unauthorized MAC addresses on selected interfaces, while DHCP snooping and DAI help address specific DHCP and ARP attacks. SSH and management access controls protect the administrative interface.
Understanding these controls is useful for network administrators and cybersecurity teams because they need to know how an attack can affect the local network and which control can reduce that risk.
Readers who want to explore the wider security process can learn more through Systech Group’s Cybersecurity Course in Chennai, which covers network security concepts alongside practical security learning.
Practical checklist for Cisco switch hardening
Use this checklist during a switch-security review.
- Identify every active access port, trunk and unused interface.
- Enable port security on suitable access ports.
- Disable unused ports and review their VLAN assignments.
- Enable DHCP snooping on the correct VLANs.
- Confirm that only verified DHCP server paths are trusted.
- Enable DAI where supported and validate the required bindings.
- Consider IP Source Guard for compatible client-facing interfaces.
- Enable PortFast and BPDU Guard on appropriate end-device ports.
- Review allowed VLANs and native VLAN settings on trunks.
- Use SSH and restrict management access.
- Review authentication, logging, SNMP and software-update settings.
- Test legitimate connectivity and the intended security behaviour.
- Save and securely back up the approved configuration.
For a broader practical understanding of how these controls fit into a defensive workflow, Systech Group’s Ethical Hacking Course in Chennai is a related learning resource.
Conclusion
Securing a Cisco switch requires more than configuring access ports, trunk ports and VLANs. Administrators should also control which devices can connect, prevent unauthorized DHCP and ARP activity, protect spanning-tree operation, limit trunk traffic and secure management access.
The most effective approach is to apply the right controls for each interface, verify their behaviour, monitor security events and document every approved change. These steps help reduce common network risks without disrupting legitimate users.
To strengthen your networking fundamentals and learn how switch configurations fit into real network environments, explore the CCNA training in Chennai
Frequently asked questions
What are the most important Cisco switch security configurations?
Start with port security, disabling unused ports, DHCP snooping, Dynamic ARP Inspection, appropriate BPDU Guard settings, secure trunk configuration and SSH-based management access.
Is port security enough to protect a Cisco switch?
No. Port security mainly controls source MAC addresses on selected interfaces. It does not replace DHCP snooping, ARP inspection, management security, VLAN controls or monitoring.
What is the difference between DHCP snooping and Dynamic ARP Inspection?
DHCP snooping filters DHCP messages and builds a binding database. Dynamic ARP Inspection validates ARP messages using trusted IP-to-MAC bindings, helping reduce ARP spoofing risks.
Should BPDU Guard be enabled on trunk ports?
Normally, BPDU Guard should be used on appropriate end-device ports, not indiscriminately on switch-to-switch trunks. An unexpected BPDU can cause a protected port to shut down.
How can I check whether Cisco switch security is configured correctly?
Use commands such as show port-security, show ip dhcp snooping, show ip arp inspection, show spanning-tree, show interfaces trunk and show ip ssh. Check the actual output and test the expected behaviour.
Are all Cisco switch security commands the same?
No. Commands and feature support vary by Cisco switch family, IOS or IOS XE release, licence and network design. Always confirm the documentation for the exact model and software version before applying a configuration.
Does switch hardening eliminate the need for a firewall?
No. Switch hardening protects selected Layer 2 functions and administrative access. Firewalls provide additional traffic-control and security functions at network boundaries and, depending on their capabilities, between internal network segments.