Cisco Switch Network-Access Port-Security – Cisco Port Security Static vs Sticky+Static

cisconetwork accessport-securityswitch

I don't see a different between the two. Both make it to the running config.

1) sticky + static

Switch1(config-if)#switchport port-security mac-address sticky ?
  H.H.H  48 bit mac address

Switch1(config-if)#switchport port-security mac-address sticky ae11.be22.ce33

2) static only

Switch1(config-if)#switchport port-security mac-address ?
  H.H.H   48 bit mac address

Switch1(config-if)#switchport port-security mac-address ae12.be22.ce33

In Running Config

interface GigabitEthernet1/0/17
 switchport access vlan 4
 switchport mode access
 switchport voice vlan 5
 switchport priority extend trust
 switchport port-security maximum 5
 switchport port-security mac-address sticky
 **switchport port-security mac-address sticky ae11.be22.ce33
 switchport port-security mac-address ae12.be22.ce33**
 duplex full
 mls qos trust cos
 spanning-tree portfast
 spanning-tree bpduguard enable

!

Confused.

Best Answer

The difference is pretty straightforward.

switchport port-security mac-address sticky

Will convert all dynamically learned MAC addresses to sticky MAC addresses so that you don't have to statically define them (like if you had a couple hundred hosts).

switchport port-security mac-address sticky ae11.be22.ce33

Simply allows you to ensure that one is added statically (as you already know). Statically defined MACs are also preserved in the configuration, so after a reboot they would not need to be relearned.

From Configuring Port Security

You can configure an interface to convert the dynamic MAC addresses to sticky secure MAC addresses and to add them to the running configuration by enabling sticky learning. To enable sticky learning, enter the switchport port-security mac-address sticky command. When you enter this command, the interface converts all the dynamic secure MAC addresses, including those that were dynamically learned before sticky learning was enabled, to sticky secure MAC addresses.

The sticky secure MAC addresses do not automatically become part of the configuration file, which is the startup configuration used each time the switch restarts. If you save the sticky secure MAC addresses in the configuration file, when the switch restarts, the interface does not need to relearn these addresses. If you do not save the configuration, they are lost.

So in your configurations case, you statically defining those MAC addresses is just redundant, anything learned on that port will be converted to a sticky MAC anyway.

Related Topic