Recognition Display Switch-Port Security Test for School Networks

Port security and Spanning Tree Protocol PortFast are configured independently, but both must be verified on a recognition display access port before the display enters unattended operation. The STP test confirms the port reaches forwarding state quickly enough for the display to obtain a DHCP lease at boot; the port security test confirms the port rejects unauthorized devices without disrupting the display’s own traffic once it is online. Schools that complete both tests before a display goes live have documented the Layer 2 baseline that IT staff can restore after any summer switch replacement.

This procedure applies to recognition displays — Windows or Linux media PCs, embedded players, and kiosk-grade appliances — connected to managed switches running Cisco IOS, Aruba OS, Juniper EX, or HP ProCurve. Port security feature names and CLI syntax differ between vendors; the conceptual steps are identical, and vendor-specific syntax is noted where it diverges.

A hall-of-fame kiosk installed in a public school hallway is accessible to students, visitors, and contractors who may connect unauthorized devices to the same network outlet — port security limits which MAC addresses the switch port will accept

What Is Switch Port Security?

Switch port security is a feature on managed Layer 2 switches that limits the number of unique source MAC addresses the switch will learn and forward on a single access port. When the number of MAC addresses observed on the port reaches the configured maximum, any new MAC address arriving on the port triggers a violation action.

Port security addresses a straightforward threat: a managed switch port with no MAC address restriction will learn and forward traffic from any device connected to it. A recognition display access port without port security will accept traffic from a laptop, hub, rogue access point, or consumer router plugged into the same outlet strip or jack as the display. Those devices may generate traffic that consumes bandwidth, triggers DHCP exhaustion, or introduces unauthorized routes into the school network. Port security does not provide authentication — it is a Layer 2 measure, not a replacement for 802.1X authentication — but it is a practical, low-configuration step that reduces the risk of accidental and opportunistic unauthorized access on display ports in public hallways and lobbies.

Three Violation Modes

The behavior when a violation occurs is controlled by the violation mode configured on the port.

Protect — The switch silently drops frames from any MAC address beyond the configured limit. The port remains up, the display continues to function, and no log message or SNMP trap is generated. The violation is invisible unless an administrator actively checks the violation counter. Protect mode is appropriate when silent enforcement is preferable and the IT team monitors port security counters periodically, but it provides no automatic alert when unauthorized devices appear.

Restrict — The switch drops frames from excess MAC addresses, increments the port’s violation counter, and generates a syslog message and SNMP trap for each violation. The port remains up and the display continues to function. Restrict mode is appropriate when the school’s monitoring infrastructure is configured to receive and alert on syslog messages, allowing IT staff to investigate unauthorized devices without disrupting the display.

Shutdown — The switch immediately places the port in err-disabled state, stopping all traffic in both directions. The display loses network connectivity and goes offline. A syslog message is generated. The port remains err-disabled until an administrator manually recovers it or until an automatic err-disabled recovery timer expires. Shutdown mode provides the strongest protection but requires a recovery procedure that does not depend on physical access to the switch when the display is in a remote building or unmanned area. Shutdown is the most common default violation mode on Cisco IOS.

Sticky MAC Learning

Sticky MAC learning (switchport port-security mac-address sticky on Cisco IOS) instructs the switch to dynamically learn the first MAC address seen on the port and convert it to a secure static entry in the running configuration. The display’s MAC address is learned automatically on first boot without requiring the IT administrator to look up and manually enter the display media PC’s hardware address. If the running configuration is saved, the sticky entry persists across switch reboots. If the configuration is not saved, sticky entries are lost on switch restart — an important distinction for post-summer recovery.

Why Port Security Matters for School Recognition Displays

A recognition display in a public hallway or lobby operates in an environment that managed-network policies are designed to protect.

The access port is in a physically accessible location. A school lobby, athletic corridor, or gymnasium entrance is not a locked server room. Students, visitors, event attendees, and contractors can physically reach the network outlet or the display’s own RJ-45 port. An unprotected port accepts any device plugged into it. Schools that display youth athlete recognition content and award histories on lobby displays need that content to remain available and uninterrupted — not consumed by unauthorized bandwidth-heavy traffic from a device sharing the same access port.

Vendor and contractor visits introduce unknown devices. During installation, maintenance, or AV upgrades, vendors may temporarily connect laptops, test equipment, or protocol analyzers to the recognition display’s network outlet. Without port security, these connections are invisible to the network and may introduce addressing conflicts or STP topology changes. Restrict mode provides a log trail of each additional device connection; Shutdown mode prevents any additional device from obtaining network access on the display port.

Unauthorized device connections are not always intentional. A student or teacher plugging in a laptop with a USB-to-Ethernet adapter near the display, a facilities team connecting a VoIP phone to the same outlet strip, or a contractor using the closest available jack without checking the switch port assignment can each trigger unexpected behavior on an unprotected display port. Port security converts accidental connections into detectable, logged events.

Port security complements PortFast and BPDU Guard. A display access port correctly configured for Spanning Tree Protocol — PortFast enabled, BPDU Guard enabled — already blocks devices that generate Bridge Protocol Data Units, primarily managed switches. Port security adds MAC address enforcement that rejects end devices such as laptops, phones, and embedded adapters that do not generate BPDUs and therefore pass through BPDU Guard undetected. The two features together cover both switch-type and end-device-type unauthorized connections on the same port.

Schools planning academic and athletic recognition events where recognition displays are moved to new locations for the evening should verify that the event-space switch ports they connect to have port security configured consistently with the display’s permanent installation port.

Port Security Decision Tree for Recognition Display Ports

Use this decision tree to identify the most critical configuration gap before running the full checklist.

1. Is port security enabled on the display’s access port?

• NO → port security is not configured; proceed to Steps 1–3 to configure it; skip the violation and recovery tests until configuration is in place
• YES → continue

↓

2. What is the maximum MAC address limit configured?

• 1 (display’s own MAC address only) → correct for most display installations; continue
• Greater than 1 without documented justification → review whether multiple MAC addresses are legitimate, such as the display’s NIC and a built-in USB hub each presenting a distinct MAC; correct the limit and continue
• Default (often 1 on Cisco IOS, but may differ by platform) → confirm the platform default is appropriate; continue

↓

3. What violation mode is configured?

• Protect → confirm syslog monitoring is in place to catch violations; consider upgrading to Restrict for log visibility
• Restrict → confirm the school’s syslog or SNMP monitoring system is receiving and alerting on port security violation messages
• Shutdown → confirm err-disabled recovery procedure is tested and documented; continue

↓

4. Has the recovery procedure been tested?

• NO → run Step 5 of the checklist to test and document the recovery before the display enters unattended operation
• YES → continue

↓

5. Is sticky MAC learning configured and the running configuration saved?

• Sticky learning not enabled → manually entered static MAC address is the alternative; confirm the display’s MAC address is in the secure MAC list
• Sticky enabled, config not saved → save the configuration (write memory) before ending the session; an unsaved sticky entry is lost on switch reboot
• Sticky enabled, config saved → continue

↓

6. Result: port security is configured, violation behavior is tested, and recovery is documented — proceed to the full checklist to verify each step

Tools Required

Pre-Test: Document the Port Security Baseline

Before making any configuration changes, record the current port security state for the display access port.

1. Log into the access switch via SSH or console. Run show version to confirm the switch model and software version.
2. Run show port-security interface <port-id> to determine whether port security is currently enabled, the configured maximum MAC address limit, the current violation mode, and whether any secure MAC addresses are currently registered on the port.
3. Run show port-security address to list all secure MAC addresses currently learned or statically configured across the switch. Identify the entry for the display access port, or confirm that no entry exists if port security has not been configured yet.
4. From the display media PC, run ipconfig /all on Windows or ip link show on Linux and record the NIC’s hardware (MAC) address. This is the address that will become the port’s single authorized secure MAC entry.
5. Log into the CMS management portal and confirm the display shows online with a current synchronization timestamp. This is the application-layer baseline before the test begins.

Record all five items before beginning Step 1 of the checklist.

Documenting the display's MAC address and the switch's current port security state before testing ensures each configuration change has a verifiable expected result and a known baseline to restore if something goes wrong

School Recognition Display Port Security Test Checklist

Step 1: Enable Port Security on the Display Access Port

Verify that port security is enabled on the port, or enable it if it is not currently configured.

1. Log into the access switch and check the current state: show port-security interface <port-id>
2. If port security is not enabled, configure it on the interface:

interface <port-id>
 switchport port-security

On Juniper EX: set interfaces ge-0/0/X unit 0 family ethernet-switching mac-limit <limit>. On Aruba/HP ProCurve: port-security <port-id> learn-mode static action send-alarm. 3. Confirm port security is now enabled by running show port-security interface <port-id> again. The Port Security field should show Enabled. 4. Note the Maximum MAC Addresses value — the default on Cisco IOS is 1, which is correct for a single-device display port. 5. Note the Violation Mode field — the Cisco IOS default is Shutdown. You will set this explicitly in Step 3.

Pass criteria: Port security shows Enabled on the display access port; maximum MAC address limit confirmed.

Step 2: Configure the Authorized MAC Address

Register the recognition display’s MAC address as the single authorized secure address on the port, using either sticky learning or a manually entered static entry.

Option A: Sticky MAC Learning (Recommended)

1. Enable sticky learning on the port:

interface <port-id>
 switchport port-security mac-address sticky

2. If the display is currently connected and online, its MAC address should already be in the port’s MAC address table. Run show port-security address interface <port-id> and confirm the display’s MAC address appears with a type of SecureSticky.
3. If the display is powered off, power it on and wait for it to obtain a DHCP lease. Then run show port-security address interface <port-id> to confirm sticky learning captured the display’s MAC address.
4. Save the running configuration immediately: write memory. The sticky MAC entry exists only in the running configuration until saved. An unsaved entry is lost on switch reboot.

Option B: Static MAC Entry (Alternative)

1. Manually enter the display’s MAC address as a static secure entry:

interface <port-id>
 switchport port-security mac-address <display-MAC-address>

The MAC address uses the format xxxx.xxxx.xxxx on Cisco IOS. 2. Run show port-security address interface <port-id> and confirm the entry appears with a type of SecureConfigured. 3. Save the configuration: write memory.

Pass criteria: show port-security address interface <port-id> shows the display’s MAC address as a SecureSticky or SecureConfigured entry; running configuration saved.

Step 3: Set and Confirm the Violation Mode

Choose and configure the violation mode appropriate for the recognition display installation, then verify the setting.

Violation Mode Selection Guide:

• Restrict is recommended for most permanently installed recognition displays. It drops frames from unauthorized MAC addresses, increments the violation counter, and generates syslog and SNMP messages — providing both protection and visibility without taking the display offline. Restrict mode is appropriate when the school’s IT environment has syslog collection in place.
• Shutdown is appropriate when stronger enforcement is required or when syslog monitoring is not available. It places the port in err-disabled when any unauthorized device connects. The recovery procedure must be tested and documented before the display enters unattended operation. Shutdown is the Cisco IOS default violation mode.
• Protect is appropriate only when operational continuity of the display is the overriding priority and the IT team commits to periodically reviewing violation counters. It provides no automatic alert.

Configure the chosen violation mode:

interface <port-id>
 switchport port-security violation restrict

Replace restrict with shutdown or protect as appropriate.

Confirm the setting: show port-security interface <port-id>. The Violation Mode field should reflect the configured value.

Pass criteria: Violation mode confirmed with show port-security interface; mode matches the intended configuration for this installation.

Step 4: Test the Violation Response

With port security configured, verify that the violation action triggers correctly when an unauthorized MAC address appears on the port.

1. Confirm the display is connected and online: run show port-security address interface <port-id> and confirm only the display’s MAC address appears.
2. Temporarily disconnect the display from the port, or shut down the interface (shutdown then no shutdown). This ensures the display’s MAC address remains registered but the port link is down.

Alternative if disconnecting the display is not feasible: Keep the display connected and plug a test laptop into the same port through a small unmanaged hub. The test laptop’s MAC address will be a second MAC beyond the limit of 1, triggering a violation while the display remains connected.

3. Connect a test laptop directly to the display access port using a standard Ethernet cable.
4. From the test laptop, attempt to obtain an IP address. If the violation mode is Restrict or Protect, the laptop’s frames are dropped and it will fail to obtain a lease — confirm by running ipconfig /renew on the test laptop and observing that it fails or times out. If the violation mode is Shutdown, the port enters err-disabled immediately.
5. Run on the switch: show port-security interface <port-id>. For Restrict mode, confirm the Security Violation Count has incremented. For Shutdown mode, confirm the port status shows err-disabled.
6. For Restrict mode, confirm a syslog message was generated: run show logging on the switch and look for a PORT_SECURITY-2-PSECURE_VIOLATION message referencing the port ID.

Pass criteria:

• Restrict mode: Laptop fails to obtain a DHCP lease; violation counter increments; syslog message recorded.
• Shutdown mode: Port enters err-disabled immediately; switch log shows the violation event.
• Protect mode: Laptop fails to obtain a lease; no log message generated (expected); violation counter increments on show port-security interface.

Step 5: Test the Recovery Procedure

For Shutdown (err-disabled) violation mode, test and document the full recovery procedure from err-disabled to normal operation without requiring a physical site visit to the switch.

Manual Recovery (Applies to All Shutdown Violations)

1. From the switch CLI, recover the err-disabled port:

interface <port-id>
 shutdown
 no shutdown

This clears the err-disabled state and brings the port back up. Disconnect the test laptop before running recovery — if the test laptop is still connected, the port may enter err-disabled again immediately. 2. Run show port-security interface <port-id> and confirm the port status returns to Secure-up with the display’s MAC address registered. 3. Confirm the display re-obtains a DHCP lease (run ipconfig /renew on the display) and the CMS portal shows the display back online with a current synchronization timestamp.

Automatic Recovery (Optional)

Configure an automatic err-disabled recovery timer for port security violations:

errdisable recovery cause psecure-violation
errdisable recovery interval 300

A 300-second (5-minute) interval means the port automatically re-enables after 5 minutes if the violating device is no longer present. Automatic recovery reduces the time IT staff must spend on-site for routine unauthorized-device incidents. Confirm this behavior is acceptable for the security posture of the installation before enabling it.

Verify automatic recovery is configured: show errdisable recovery. The psecure-violation cause should show Enabled with the interval displayed.

Pass criteria:

• Manual recovery: Port returns to Secure-up within 30 seconds of the shutdown/no shutdown cycle; display re-obtains DHCP lease; CMS portal shows display online.
• Automatic recovery (if configured): show errdisable recovery confirms psecure-violation recovery Enabled; interval documented.

Step 6: Document Results and Make a Go / No-Go Decision

Record the full port security test before releasing the display to unattended operation.

Go / No-Go rule: All items applicable to the chosen violation mode must show a passing result before the display enters unattended operation. A display access port in Shutdown mode without a tested and documented recovery procedure should not be placed in an unattended public location — an unexpected violation event would leave the display offline until IT staff manually recover the port.

A completed port security record documents the authorized MAC address, violation mode, and recovery procedure for the display port — the reference an IT administrator needs to restore the correct configuration after any summer switch replacement

Troubleshooting: Common Port Security Failures

Post-Test Steps Before Returning to Unattended Operation

After all test items pass, complete these steps before closing the commissioning session.

1. Save the switch configuration. Run write memory (Cisco IOS) to save the port security configuration — including sticky MAC entries, violation mode, and maximum MAC limit — to the startup configuration. An unsaved configuration is lost on the next switch reboot or power event.

2. Add a port description. Apply a description to the switch interface identifying the port as the recognition display connection and its security configuration:

interface <port-id>
 description Recog-Display-Lobby-PortSecurity-Restrict

Port descriptions appear in show interfaces status output and SNMP monitoring data, allowing future IT staff to identify the display port without referencing external documentation.

3. Document the commissioning record. Record the switch name, port ID, secure MAC address, maximum MAC limit, violation mode, auto-recovery configuration, and the display’s IP address in the display’s asset record. Schools that add recognition displays to honor academic achievement milestones and honor society inductees across multiple campus buildings need each display port’s security configuration recorded in a single reference document accessible to IT staff in any building.

4. Verify CMS synchronization is current. After completing the violation and recovery tests, open the CMS management portal and confirm the display shows online with a current synchronization timestamp. Port security configuration and testing activity can temporarily disrupt the display’s application-layer connection — confirm it has recovered fully before leaving the commissioning session.

5. Schedule an annual verification. Add an annual check to the school’s IT calendar to verify port security configuration — secure MAC address, violation mode, and automatic recovery timer — on the display access port at the start of each school year, especially after any switch replacement or configuration reset during summer maintenance. A switch restored from a vendor factory default will not have port security configured; the display will operate normally in terms of connectivity, but without the MAC address enforcement the port security test was designed to confirm.

Recording the switch configuration in the display's commissioning document allows IT staff to restore the correct port security settings after any summer switch replacement without repeating the full test procedure from scratch

Port Security Considerations for Multi-Display School Installations

Schools running recognition displays in multiple locations face additional port security considerations that go beyond a single-port test.

Each display port has a unique MAC address and must be configured independently. Sticky MAC learning on one port captures only the device connected to that specific port. IT teams managing five or six display ports across a school building should configure and document each port’s secure MAC address individually. Using a consistent violation mode and maximum MAC limit across all display ports simplifies troubleshooting when a violation is reported — the behavior and recovery procedure are the same regardless of which display is affected.

Replacement hardware requires a MAC address update at the port level. When a display media PC or embedded player is replaced — after a hardware failure, an upgrade cycle, or a theft — the new unit’s MAC address differs from the registered secure address on the access port. IT staff who receive the replacement unit should retrieve its MAC address before installation and update the switch port configuration before connecting the new unit. Schools that have replaced hardware without updating the port security configuration discover the problem when the new unit triggers an immediate violation — a recoverable but avoidable disruption.

Event deployments and temporary installations require portable port security planning. Schools that deploy recognition displays at senior awards nights, banquets, and recognition ceremonies by connecting the display to event-space network ports should apply the same MAC address limit and violation mode to those event ports in advance. A display connected to an event-space port with no port security provides no protection against other event attendees connecting devices to the same jack — in a crowded gymnasium or auditorium, that is a more realistic risk than in a daily-use hallway.

Summer switch replacements reset port security to defaults — no security, not maximum security. A factory-default managed switch has port security disabled on all ports. A display reconnected to a replacement switch after summer operates without MAC address enforcement until IT staff re-apply the configuration. The display will function — network traffic is not blocked — but the documented port security baseline is no longer in place. Add switch replacement to the trigger list for post-maintenance port security verification, not just annual calendar-based checks.

Schools that host multi-school athletic events and championship recognition programs and want to display recognition content from a portable display in a visiting venue should coordinate with the host school’s IT team to confirm which ports are available and whether port security limits need to be temporarily adjusted for the visiting display.

Schools running recognition displays across multiple hallways and access switches should apply a consistent port security template — same violation mode, same MAC limit — to every display port, with each port's unique secure MAC address documented in the commissioning record

Frequently Asked Questions

Does port security work with DHCP? Will limiting the port to one MAC address interfere with DHCP lease renewal?

No. Port security operates at Layer 2 (Ethernet MAC addressing) and does not interact with Layer 3 DHCP processing. The display’s DHCP client uses the display’s own NIC MAC address in DHCP DISCOVER and REQUEST frames. Since the display’s MAC address is the registered secure address on the port, its DHCP traffic passes through normally. Port security only blocks frames from MAC addresses other than the registered secure addresses — DHCP frames from the display’s own NIC are never blocked.

If I configure port security on the display port, does that affect my ability to remotely access the switch for CMS configuration or troubleshooting?

No. Remote SSH or SNMP access to the switch is not affected by port security configuration on the display access port. Port security is a per-port feature that restricts traffic on the specific access port where it is configured — it does not affect management traffic arriving on the switch’s management interface, uplink ports, or other access ports. Configuring port security on a display port has no impact on your ability to log into the switch remotely.

Is port security a replacement for 802.1X authentication on the display port?

No. Port security restricts which MAC addresses can use the port but does not authenticate those devices against a directory server or certificate authority. A MAC address can be spoofed by a device that reads the display’s hardware address and presents it as its own — an action that bypasses port security but would be detected by 802.1X. For most school recognition display installations, port security is an appropriate and proportionate control for unattended access ports in hallways and lobbies; 802.1X provides stronger authentication for ports where the risk profile warrants the additional configuration complexity.

What happens to port security if the display is temporarily replaced by a different unit during a repair?

The replacement unit will have a different MAC address than the registered secure address on the port. When the replacement unit connects, its frames will trigger a violation. Before swapping the display hardware, update the port’s secure MAC address to the replacement unit’s MAC. If the replacement is unplanned, IT staff can temporarily disable port security on the port (no switchport port-security), allow the replacement unit to connect and be verified, then re-configure port security with the new unit’s MAC address and re-enable it.

How does port security interact with Spanning Tree PortFast and BPDU Guard?

Port security, PortFast, and BPDU Guard are independent Layer 2 features that operate alongside each other on the same access port. PortFast controls how quickly the port transitions to Forwarding state after a link-up event. BPDU Guard disables the port if it receives a Bridge Protocol Data Unit from a managed switch connected accidentally. Port security limits which MAC addresses can communicate on the port. All three should be configured on recognition display access ports. A port with PortFast and BPDU Guard but without port security allows any end device to connect and communicate freely; adding port security closes that gap.

How do I find the display’s MAC address without physically accessing the device?

On Windows 10/11 display media PCs, run ipconfig /all from any command prompt or PowerShell session — the Physical Address line for the active Ethernet adapter is the NIC’s MAC address. On Linux-based display players, ip link show lists all network interfaces with their hardware addresses. If remote access to the display’s operating system is not available, the MAC address can also be found by checking the switch’s MAC address table before port security is enabled: show mac address-table interface <port-id> lists the addresses the switch has seen on the port. Many display hardware vendors also print the NIC’s MAC address on a label attached to the device or in the device management interface.

Should I configure port security before or after configuring PortFast and BPDU Guard?

Either order works — all three features are independent and can be applied in any sequence. A practical approach is to configure PortFast and BPDU Guard first (which ensures the display can obtain a DHCP lease at boot), verify that the display connects and appears online in the CMS portal, and then add port security. This sequence makes it easier to isolate any connectivity issue: if the display fails to connect after BPDU Guard is added, the cause is a BPDU-generating device; if it fails after port security is added, the cause is a MAC address mismatch. Configuring all three simultaneously makes it harder to identify which feature caused an unexpected behavior during the commissioning session.

Schools that deploy recognition displays — hall-of-fame kiosks, donor walls, athletic championship boards and senior superlative honors — in public hallways and lobbies commit to keeping that content reliably available to students, staff, and visitors throughout the school year. Running a school recognition display port security test at commissioning confirms that the switch port protects the display’s network access point from unauthorized devices, that the violation response is calibrated to the school’s operational reality, and that the IT team can recover from a violation event without dispatching staff to a remote part of the building. Document the secure MAC address, violation mode, and recovery procedure in the display’s commissioning record, save the switch configuration, and schedule an annual post-summer verification so summer switch replacements do not silently remove the security baseline the test put in place.