What is port security?
Port security is a feature of a managed switch that defines, per port, which and how many MAC addresses may send traffic, and that automatically takes action when an unknown device appears on that port. The switch then blocks the traffic, reports the violation or shuts the port down. In OT networks, where a port stays connected to the same PLC, HMI or drive for years, this is a simple way to restrict network access to known, trusted devices.
Port security is a form of layer 2 security and is related to MAC Filtering and MAC Binding. The difference lies in the binding to a physical port and in the response to a violation.
🧠 How does port security work?
A switch normally learns every source MAC address that arrives and stores it in its MAC address table (the CAM table). Port security ties that learning to rules per port:
- Set a maximum - you decide how many MAC addresses a port may learn. On Cisco switches the default is one.
- Define the allowed addresses - addresses are entered statically, learned dynamically or fixed as sticky addresses.
- Check every frame - each incoming frame is compared with the list. A known address is forwarded.
- Respond to a violation - when an unknown address appears, or more addresses than the maximum, the configured action follows.
The three ways of defining addresses differ mainly in how they are managed:
| Type | How it is defined | After a reboot | Suitable for |
|---|---|---|---|
| Static | Entered manually per port | Retained | Critical ports with fixed devices |
| Dynamic | Learned automatically, up to the maximum | Lost | Temporary or changing connections |
| Sticky | Learned automatically and written to the running configuration | Retained if the configuration has been saved | Large numbers of ports without manual work |
Sticky learning is the most common choice for fixed installations: you connect the installation, the switch learns the devices present and you save the configuration. Note that sticky addresses only survive a reboot when the configuration has actually been saved.
⚙️ What actions can a switch take on a violation?
On Cisco switches the violation modes are called protect, restrict and shutdown. Other vendors use different names, but the principle is the same:
| Mode | Unknown traffic | Notification (Syslog / SNMPv3) | Port stays up | Typical use |
|---|---|---|---|---|
| Protect | Silently dropped | No | Yes | Rarely advisable: you see nothing |
| Restrict | Dropped | Yes, plus a counter | Yes | Production ports where downtime is too costly |
| Shutdown | Port goes err-disabled | Yes | No | Default setting; office and spare ports |
On Cisco switches port security and sticky learning are disabled by default; once you enable port
security, a maximum of one MAC address and shutdown mode apply. A disabled port comes back through a
manual shutdown / no shutdown or through automatic recovery with errdisable recovery cause psecure-violation, after 300 seconds by default. On Cisco switches port
security only works on ports statically configured as access or trunk ports, not on ports that negotiate
their mode dynamically. Industrial switches offer similar functions: Hirschmann HiOS, for example,
provides MAC-based port security combined with Auto-Disable.
In an OT environment restrict is often the wisest choice for ports facing controllers. Only traffic from the unknown address is refused; the port itself stays up, so the known device and any daisy-chained devices keep communicating and nobody has to recover the port by hand. The notification still reaches your SIEM or network monitoring.
A typical configuration for a port facing a PLC looks like this on a Cisco switch:
interface GigabitEthernet1/0/5
switchport mode access
switchport port-security maximum 1
switchport port-security mac-address sticky
switchport port-security violation restrict
switchport port-security
Afterwards, show port-security interface shows the number of learned addresses and the
violation counter. Dynamically learned addresses can expire automatically through aging (0 to
1,440 minutes); sticky addresses do not age.
🛡️ Which attacks does port security protect against?
- Unauthorised devices - a visitor’s laptop or a router someone brought in, plugged into a free port in a control cabinet, gets no access. Such devices are called rogue devices.
- Device substitution - anyone who unplugs an HMI and connects a laptop to the same cable is noticed immediately.
- MAC flooding - an attacker fills the switch’s CAM table with fake addresses. Once it is full, the switch floods all traffic to every port in the VLAN, which makes eavesdropping possible. The macof tool has done this since 1999. A maximum of one address per port makes the attack impossible through that port.
- Unwanted switches - an unmanaged switch behind a port brings multiple addresses and therefore exceeds the maximum.
Port security does not protect against an attacker who copies the MAC address of an allowed device (MAC spoofing). The address is often printed on the rating plate or can be read from the network. That is why port security is a baseline measure within defence in depth and not real authentication.
🔄 What is the difference between port security and 802.1X?
| Aspect | Port security | 802.1X |
|---|---|---|
| Identification | MAC address, locally on the switch | Certificate, account or MAC address via a RADIUS server |
| Infrastructure | The switch only | Switch, RADIUS server, often a NAC platform |
| Resistant to spoofing | No | Yes, with certificate-based authentication |
| Support in OT devices | Every device with a network port | Many older PLCs and I/O modules lack an 802.1X client |
| Management on replacement | Update the list per switch | Managed centrally |
In practice the two complement each other. 802.1X with MAC Authentication Bypass as a fallback is in OT often MAC-based too, but centrally managed. Port security therefore remains useful on switches where no RADIUS is available, and as a second layer alongside ACLs, DHCP Snooping, Dynamic ARP Inspection and IP Source Guard.
🏭 How do you apply port security in an OT network?
Port security works best at levels 1 and 2 of the Purdue Model: the switches in control cabinets and process cells, where each port connects to one fixed device and the topology rarely changes. A practical approach:
- Take inventory - list, per switch port, the connected device and its MAC address. An up-to-date asset inventory is the basis for this.
- Disable unused ports - a free port that is administratively shut down is the strongest form of port security. Preferably place such ports in an unused VLAN.
- Choose a mode per port type - restrict for ports facing controllers, shutdown for service and spare ports.
- Learn addresses with sticky learning - during a maintenance window, then save the configuration.
- Forward notifications - via Syslog and SNMPv3 to a central platform, so that every violation is investigated. Some organisations also show the status in SCADA, so operators immediately see a port that has gone down.
- Record it in change management - anyone replacing a faulty PLC or IO module must know that the new MAC address has to be registered on the switch. Use RBAC to limit who may change the switch configuration, and arrange temporary exceptions for vendors through your remote access policy rather than through an open port.
Not every port is suitable. Uplinks between switches and ring ports (as in ring redundancy) see many addresses pass and do not get port security. Ports facing a virtualisation host or a device with its own pass-through switch port, such as many ProfiNET devices, need a higher maximum. Test this beforehand.
In standards, port security appears as a concrete implementation of broader requirements. IEC 62443-3-3 requires device identification and authentication from security level 2 (SR 1.2) and asks in SR 7.7 to restrict unnecessary functions, ports, protocols and services. CIS Controls v8 safeguard 13.9 calls for port-level access control, with 802.1X as the preferred method. For organisations covered by the Dutch Cybersecurity Act (Cyberbeveiligingswet, in force since 15 August 2026), port security is a low-threshold measure you can show as part of your duty of care, provided the notifications are actually followed up.
❓ Frequently asked questions
Is port security enough to secure an OT network?
No, port security on its own is not enough. MAC addresses are easy to copy, so port security mainly stops accidental and untargeted connections. Combine it with network segmentation, a firewall between zones and monitoring.
What happens if I replace a PLC while port security is enabled?
The new device has a different MAC address, so port security treats it as a violation. In shutdown mode
the port goes down and communication is lost; in restrict mode the traffic is blocked. Make removing the
old sticky address (on Cisco with clear port-security sticky) and letting the switch learn
the new one a fixed step in your replacement procedure.
Does port security work on industrial switches?
Yes, most managed industrial switches support port security or a comparable MAC-based port protection. The name and the available actions differ per vendor, for example Auto-Disable on Hirschmann switches. Unmanaged switches do not have this function.
What is sticky MAC in port security?
Sticky MAC is a port security method in which the switch automatically learns the first MAC address on a port and writes it into the configuration as a fixed address. This saves you entering addresses manually. Sticky addresses are only retained after a reboot if you have saved the configuration.
How many MAC addresses should I allow per port?
For a port with a single fixed device, such as a PLC or HMI, one MAC address is the best port security setting. Devices with a built-in switch, IP phones with a pass-through port or virtualisation hosts need more. Always set the maximum as low as possible.
Can port security disrupt production?
Yes, port security can disrupt production when a port unexpectedly shuts down after a replacement or a configuration error. Use restrict instead of shutdown mode on critical ports so the port stays up, and test changes in a maintenance window first. With a replacement procedure that includes updating MAC addresses, the risk stays small.
📌 In summary
Port security binds switch ports to known MAC addresses and acts on deviations: blocking traffic, raising a notification or disabling the port. It is simple, works on virtually every managed switch and stops rogue devices and MAC flooding. It does not help against copied MAC addresses, so it belongs in a layered approach together with 802.1X, segmentation and monitoring.
Port security is a low-cost first line of defence for your OT network: shut down unused ports, limit every active port to its known device and make sure every violation produces a notification that someone follows up.