Study guide
9.2 Port Security and MAC Address Limiting
HPE Aruba Networking Certified Associate - Campus Access HPE6-A85
Track your progress as you read
Finished sections get a check mark.
1 Introduction: HPE6-A85 Exam Overview
HPE6-A85 Exam Facts and Current Blueprint
2 Chapter 1: Network Stack Fundamentals
1.1 OSI Reference Model and Encapsulation 1.2 TCP/IP Protocol Suite and IP Headers 1.3 Layer 2 Operation, ARP, and 802.1Q Tagging
3 Chapter 2: Physical Connectivity and Host Addressing
2.1 Ethernet Media and Transceiver Standards 2.2 Power over Ethernet (PoE, PoE+, PoE++) Standards and Budgeting 2.3 LLDP, LLDP-MED, and Voice VLAN Configuration 2.4 Host IP Addressing and DHCP Relay Operations
4 Chapter 3: Network Resiliency and Virtualization
3.1 Virtual Switching Framework (VSF) Architecture and Topologies 3.2 VSF Split Detection, Failover, and Auto-Stacking 3.3 Virtual Switching Extension (VSX) Architecture and Operations 3.4 High-Availability Gateways: VRRP and VSX Active-Gateway
5 Chapter 4: AOS-CX Architecture and Switch Operation
4.1 AOS-CX Hardware Portfolio and State Database Architecture 4.2 Network Analytics Engine (NAE) and Automated Telemetry 4.3 AOS-CX Interface Configuration and Port Control 4.4 Link Aggregation (LAG) and LACP Configuration
6 Chapter 5: Layer 2 Protocols and Spanning Tree
5.1 AOS-CX VLAN Configuration and Native VLAN Handling 5.2 Spanning Tree Protocols: STP, RSTP, and MSTP 5.3 Spanning Tree Protections and Loop Prevention 5.4 MAC Address Table Learning, Aging, and Forwarding
7 Chapter 6: Wireless Fundamentals, Standards, and RF
6.1 IEEE 802.11 Standards and Wi-Fi Generations 6.2 RF Fundamentals, Signal Propagation, and Channel Design 6.3 Aruba Access Point Hardware Portfolio and Suffix Conventions 6.4 WLAN Topologies, BSSID/ESSID, and Roaming Standards
8 Chapter 7: Aruba Wireless Architecture and Management
7.1 AOS 10 Architecture and Aruba Central Integration 7.2 Wireless Forwarding Modes: Bridge vs Tunnel Mode 7.3 Automated RF and Client Optimization: AirMatch and ClientMatch 7.4 Secure Wireless Access: WPA3, SAE, and MPSK Implementation
9 Chapter 8: IP Routing Fundamentals and OSPF
8.1 IP Routing Principles and Packet Forwarding 8.2 OSPFv2 Protocol Mechanics and Adjacency Formation 8.3 OSPF Designated Routers and Multi-Area Deployments 8.4 ECMP, Static Routing, and VRF Isolation
10 Chapter 9: Campus Network Security and Segmentation
9.1 DHCP Snooping and Dynamic ARP Inspection 9.2 Port Security and MAC Address Limiting 9.3 ClearPass Policy Management and RADIUS Change of Authorization 9.4 Dynamic Segmentation, User-Based Tunneling, and Policy Enforcement
11 Chapter 10: Authentication, Authorization, and Accounting
10.1 The AAA Framework and Architecture 10.2 802.1X Authentication and EAP Methods 10.3 MAC Authentication and Captive Portal Onboarding 10.4 Administrative Access Control: RADIUS vs TACACS+
12 Chapter 11: Network Management and Telemetry
11.1 Aruba Central Cloud Architecture and Group Configuration 11.2 Zero-Touch Provisioning (ZTP) and Aruba Activate 11.3 AI Insights and Aruba User Experience Insight (UXI) 11.4 Network Telemetry, Streaming APIs, and SNMP/Syslog
13 Chapter 12: Troubleshooting the Solution
12.1 Structured Troubleshooting Methodologies and Scope Isolation 12.2 AOS-CX Layer 2 and Interface Diagnostic Commands 12.3 Layer 3, IP Services, and End-to-End Diagnostics 12.4 Physical-Layer Troubleshooting 12.5 Troubleshooting Wireless Clients and Network Access
14 Chapter 13: Optimizing Performance: QoS, Baselines, and Comparisons
13.1 Quality of Service (QoS) Classification and Marking 13.2 Queuing Algorithms and Congestion Management 13.3 Traffic Policing, Shaping, and Broadcast Rate Limiting 13.4 Establishing a Performance Baseline 13.5 Comparing Results to the Baseline
15 Chapter 14: Plan the Solution
14.1 Analyzing the Current Environment 14.2 Interpreting an Architect's High-Level Design 14.3 Creating a Low-Level Design 14.4 Preparing for Implementation
16 Chapter 15: Validate and Operate the Solution
15.1 Validating the Solution 15.2 Performing Firmware Updates 15.3 Making Basic Ongoing Configuration Changes 15.4 Maintaining Network Documentation
9.2 Port Security and MAC Address Limiting
Key Takeaways Explain This Topic AI
CAM table flooding attacks exploit switch MAC learning mechanisms to exhaust memory, forcing switches into fail-open hub mode where unicast traffic is flooded across all ports.
MAC address limiting restricts the maximum number of simultaneous Layer 2 MAC addresses permitted on an access interface, preventing unauthorized switches, hubs, or rogue APs.
AOS-CX port security learns MACs dynamically by default up to the client limit (default 1), accepts static MACs with mac-address , and makes learned MACs sticky with sticky-learn enable ; sticky clients survive reboots and link flaps.
port-access security violation action {notify | shutdown} sets the violation response: notify (default) blocks the intruder and logs an event and SNMP trap, while shutdown disables the port and can auto-recover after a recovery timer.
Port security provides basic Layer 2 device containment at the physical port level, serving as a first line of defense before advanced identity-based authentication mechanisms like 802.1X.
Last updated: October 2026
Port Security and MAC Address Limiting
Quick Summary: Ethernet switches make forwarding decisions using a Content Addressable Memory (CAM) table that dynamically learns source MAC addresses arriving on physical interfaces. Malicious actors exploit this mechanism through CAM table flooding attacks , overwhelming switch memory with randomized MAC addresses to force the switch into a broadcast "fail-open" mode. Port Security and MAC Address Limiting mitigates this threat by capping the number of permitted MAC addresses on an interface; unauthorized clients are always blocked, and the violation action ( notify or shutdown ) decides whether the switch only reports the violation or also disables the port.
The MAC Address Table and CAM Flooding Attacks
To forward unicast frames efficiently, an Ethernet switch maintains a hardware-accelerated forwarding database known as the MAC Address Table or Content Addressable Memory (CAM) table . When a frame enters a physical port, the switch ASIC reads the Source MAC address and records it alongside the ingress port and VLAN ID. Future frames destined for that MAC address are switched directly out that specific port rather than flooded across the VLAN.
The Mechanics of CAM Table Flooding
Hardware CAM tables possess finite memory capacity (typically 8,000 to 64,000 MAC addresses depending on switch platform specifications, such as the Aruba CX 6100 vs. CX 6300). Attackers take advantage of this physical limitation using automated flooding tools (such as macof ): +---------------------------------------------------------------------------------------------------------+
- | CAM TABLE FLOODING ATTACK MECHANICS |
- | |
- | [ Attacker Workstation ] |
- | | (Transmits 50,000 frames/sec with randomized Source MACs: 00:01:aa..., 00:02:bb...) |
- | v |
- | [ Access Switch CAM Table ] ---> [ Full: 32,768 / 32,768 MACs Exhausted! ] |
- | | |
- | v |
- | [ Switch Enters Fail-Open State: Acts Like a Legacy Shared Hub ] |
- | | |
- | +-----> Floods ALL Unicast Frames to All Ports in VLAN! |
- | +-----> Attacker passively sniffs confidential user sessions, credentials, and traffic! |
- +---------------------------------------------------------------------------------------------------------+
High-Velocity Frame Transmission: The attacker floods the physical switch port with tens of thousands of Ethernet frames per second, each featuring a randomized, bogus source MAC address.
Table Saturation: The switch rapidly updates its CAM table, learning the bogus MACs until memory capacity is entirely exhausted. Legitimate dynamic host entries are aged out or overwritten.
The "Fail-Open" Condition: Once the CAM table is full, the switch cannot learn new addresses. When a legitimate frame arrives destined for an address missing from the CAM table, the switch must treat it as an unknown unicast frame. Standard Layer 2 behavior requires flooding unknown unicast frames out every port within the broadcast domain.
Passive Eavesdropping: By forcing the switch into this hub-like broadcasting state, the attacker connects a packet analyzer (such as Wireshark) and passively captures confidential traffic passing between other legitimate workstations, completely undermining Layer 2 privacy.
Port Security and MAC Address Limiting Principles
Port Security provides edge protection by restricting the number and identity of MAC addresses permitted to transmit traffic through a physical switch interface. It achieves three primary operational objectives:
CAM Table Protection: Caps the maximum number of MAC addresses learned on any single port, ensuring that a single compromised endpoint cannot exhaust the entire switch forwarding table.
Rogue Switch and AP Prevention: Prevents users from attaching unmanaged desktop switches, consumer Wi-Fi routers, or wireless extenders to cubicle wall jacks to connect unauthorized multiple devices.
Physical Access Lockdown: Binds authorized device MAC addresses to specific physical ports, preventing unauthorized hardware from communicating if plugged into an enterprise network jack.
MAC Address Learning Modes: Dynamic, Static, and Sticky
Aruba AOS-CX port security supports three methods for defining and retaining authorized MAC addresses:
Learning Mode Operational Behavior Retention Across Reboots Administrative Overhead
Dynamic Learning The default. MAC addresses are learned dynamically from incoming frames up to the configured client-limit . Relearned after a reboot or link flap. Minimal; fully automated.
Static Binding The administrator configures exact authorized MAC addresses ( mac-address <mac> in the port-security context). You can also configure some MACs and let the port learn the rest. Stored in the configuration file; survives reboots. High; requires manual tracking of every network card replacement.
Sticky Learning sticky-learn enable makes all existing and newly learned non-static MACs sticky (sticky-dynamic); sticky MACs can also be configured (sticky-static). Sticky clients are not affected by a reboot or link flap once learned (AOS-CX 10.14 Security Guide). Low; captures authorized devices on initial connection without manual typing.
Sticky MAC Learning Mechanics
Sticky MAC learning delivers the convenience of dynamic learning combined with the security of static bindings. When an administrator enables sticky learning on an access port, the MACs learned on that port become sticky. If the switch reboots or the cable is disconnected, the port continues to permit only those MAC addresses, preventing an unauthorized user from disconnecting the corporate PC and attaching a rogue laptop. Moving a sticky client to a different port is itself a violation ( show port-access security violation sticky-mac-client-move interface ).
Violation Modes and Administrative Actions
A port security violation occurs when a frame arrives on a secured interface from a source MAC address that is not authorized and the port has already reached its client limit. On AOS-CX, port security always blocks the intruding device from sending traffic through the port; the configured action decides what else happens (AOS-CX 10.14 CLI and Security Guides): +---------------------------------------------------------------------------------------------------------+
- | PORT SECURITY VIOLATION ACTIONS |
- | |
- | [ Action: NOTIFY (default) ] ---> Intruder blocked; authorized clients keep working. |
- | Event log entry + SNMP trap ("Client limit exceeded on port ..."). |
- | |
- | [ Action: SHUTDOWN ] -----------> Port is shut down; all clients on it lose service. |
- | Optional auto-recovery after a recovery timer. |
- +---------------------------------------------------------------------------------------------------------+
- Detailed Analysis of Violation Actions
notify (default):
Action: The unauthorized client is blocked, and the switch writes an event-log entry (for example, "Client limit exceeded on port 1/1/8, caused by an unauthenticated client ...") and sends an SNMP trap.
Impact: Authorized MAC addresses on the port continue to forward normally.
Use Case: Standard enterprise offices where the security team wants visibility without disrupting legitimate users.
shutdown :
Action: The switch shuts down the port where the client limit was exceeded.
Impact: All traffic stops on the port, including traffic from previously authorized endpoints and IP phones.
Recovery: Manual shutdown / no shutdown , or automatic recovery with port-access security violation action shutdown auto-recovery enable and port-access security violation action shutdown recovery-timer <seconds> (auto-recovery is disabled by default).
Use Case: High-security environments where any unauthorized connection indicates tampering.
Note: Other platforms offer a silent "protect" or "drop" mode. On AOS-CX the choice is only notify or shutdown; blocking the intruder happens in both.
AOS-CX Configuration Commands and Verification
The following configuration session enables port security globally and on a port, sets a client limit of 2 (an IP phone and a PC), enables sticky learning, and chooses the shutdown action with auto-recovery: switch# configure terminal
- ! Step 1: Globally enable port security
- switch(config)# port-access port-security enable
- ! Step 2: Configure Port Security on an Access Interface
- switch(config)# interface 1/1/10
- switch(config-if)# description Desk-10-PC-and-Phone
- switch(config-if)# no routing
- switch(config-if)# vlan access 10
- switch(config-if)# port-access port-security enable
- switch(config-if)# port-access port-security
- switch(config-if-port-security)# client-limit 2
- switch(config-if-port-security)# sticky-learn enable
- switch(config-if-port-security)# exit
- switch(config-if)# port-access security violation action shutdown
- switch(config-if)# port-access security violation action shutdown auto-recovery enable
- switch(config-if)# exit
- ! Step 3: Manual Recovery for a Shut-Down Port
- switch(config)# interface 1/1/10
- switch(config-if)# shutdown
- switch(config-if)# no shutdown
- switch(config-if)# exit
- Essential Verification Commands
Command Output and Diagnostic Purpose
show port-access port-security interface 1/1/10 client-status Shows the authorized clients on the port and whether each is static, dynamic, sticky-static, or sticky-dynamic.
show port-access port-security interface 1/1/10 port-statistics Shows client counts and limits for the port.
show port-access port-security violation client-limit-exceeded interface 1/1/10 Displays client-limit violations and the offending MAC addresses.
show mac-address-table interface 1/1/10 Displays active hardware forwarding entries associated with interface 1/1/10.
Port Security vs. Enterprise Network Access Control (802.1X)
It is vital for enterprise network engineers to understand the architectural boundary between basic port security and enterprise Network Access Control (NAC):
Port Security Limitations: Port security operates strictly on unauthenticated Layer 2 MAC addresses. Because MAC addresses can be easily sniffed and spoofed by an attacker using free software utilities, port security does not provide cryptographic identity verification.
Enterprise NAC (802.1X / ClearPass): Enterprise environments deploy IEEE 802.1X port-based authentication backed by Aruba ClearPass Policy Manager. 802.1X enforces cryptographic user credentials or digital certificates, role-based access control, dynamic VLAN assignment, and posture assessment, providing comprehensive Zero Trust access control.
Common Exam Traps
Global Enablement Prerequisite: Port security must be enabled globally ( port-access port-security enable in config context) as well as on the port. Omitting the global command is a frequent troubleshooting trap.
Sticky Means Persistent: On AOS-CX, sticky-learned clients are not affected by a switch reboot or link flap. Disabling sticky learning turns them back into dynamic clients.
Shutdown vs. Notify: The exam frequently tests which violation action keeps authorized devices working. shutdown disables the entire port (cutting off all users), whereas notify (the default) blocks only the intruder and reports the violation.