Which of the Following is Required When Configuring Port Security with Sticky Learning?

The Cisco 200-301 exam, also known as CCNA (Cisco Certified Network Associate), covers foundational networking knowledge. Key topics include network fundamentals, IP connectivity, IP services, security fundamentals, automation, and programmability. Understanding these core areas helps candidates prepare for configuring, managing, and troubleshooting small to medium-sized networks.

Tech Professionals

11 April 2025

Cisco

Which of the Following is Required When Configuring Port Security with Sticky Learning?

Introduction To Cisco 200-301 exam topics

The Cisco Certified Network Associate (CCNA) 200-301 exam is a crucial stepping stone for aspiring network professionals. It validates foundational networking knowledge and skills, covering a broad range of topics essential for today's IT landscape. Among these critical areas is network security, and within that domain, port security stands out as a fundamental mechanism for controlling access and mitigating threats at the Layer 2 level.

For those diligently preparing for the Cisco 200-301 exam, understanding the intricacies of port security, particularly the concept of "sticky learning," is paramount. This blog post delves deep into this specific aspect, aiming to clarify the requirements and benefits of configuring port security with sticky MAC addresses. By exploring this topic in detail, we'll not only answer the titular question but also reinforce your understanding of a key area within the Cisco 200-301 exam syllabus.

Understanding Port Security: A First Line of Defense

Before we dive into sticky learning, let's briefly recap the core principles of port security. Port security is a Layer 2 feature implemented on switch ports to restrict the number of valid MAC addresses allowed on that port. This helps prevent unauthorized devices from gaining access to the network and mitigates MAC address spoofing attacks.

When port security is enabled, the switch learns the MAC addresses of legitimate devices connected to the port. Any attempt by a device with an unknown MAC address to access the port can trigger a security violation, leading to predefined actions such as discarding traffic, logging the violation, or even shutting down the port.

Introducing Sticky Learning: Dynamic Security with Persistence

Traditional port security configuration involves manually specifying the allowed MAC addresses on each port. While effective, this approach can be time-consuming and require constant updates as devices are added, removed, or moved. This is where "sticky learning" comes into play, offering a more dynamic and manageable solution.

Sticky learning allows the switch to automatically learn and save the MAC addresses of connected devices. When a port is configured with sticky learning, the first device (or the specified number of devices) that connects to the port has its MAC address automatically learned and added to the running configuration. These dynamically learned MAC addresses are then "stuck" to the port.

The Titular Question: Unraveling the Requirement

Now, let's address the core question: Which of the following is required when configuring port security with sticky learning?

The answer lies in understanding the fundamental purpose and operation of sticky learning. When you configure sticky learning on a switch port, the switch needs a mechanism to store the dynamically learned MAC addresses. This storage must persist even after a switch reboot. Therefore, the crucial requirement for configuring port security with sticky learning is the saving of the dynamically learned MAC addresses to the running configuration.

Let's break down why this is essential and explore the implications:

Persistence Across Reboots: Without saving the learned MAC addresses to the running configuration, the information would be lost upon a switch reload. This would defeat the purpose of sticky learning, as the switch would have to relearn the MAC addresses every time it restarts, effectively making it function like basic port security without any persistent learning.

Maintaining Security Policies: Saving the learned MAC addresses ensures that the security policy defined by the initially connected devices remains intact even after interruptions. This prevents unauthorized devices from connecting during a reboot window.

Configuration Review and Management: Storing the learned MAC addresses in the running configuration allows network administrators to review and manage the security settings of the port. They can see which MAC addresses have been automatically learned and can manually adjust the configuration if needed.

How Sticky Learning Works in Practice

When you enable sticky learning on a port, the following process typically occurs:

1. Initial Connection: When a device connects to the port for Study4pass the first time, its MAC address is learned by the switch.
2. Dynamic Learning and Storage: The switch dynamically adds this MAC address to the port's security configuration in the running configuration.
3. Subsequent Connections: If a device with a MAC address already stored in the sticky configuration connects to the port, access is granted.
4. Violation Handling: If a device with a MAC address not in the sticky configuration attempts to connect, a security violation occurs, and the configured violation action (e.g., restrict, protect, shutdown) is triggered.
5. Saving to Startup Configuration: To ensure persistence across reboots, it is crucial to save the running configuration to the startup configuration using commands like copy running-config startup-config or write memory. This step ensures that the sticky learned MAC addresses are loaded when the switch restarts.

Exploring Related Cisco 200-301 Exam Topics

Understanding sticky learning is just one piece of the port security puzzle within the Cisco 200-301 Certification. Other related topics you should be familiar with include:

Port Security Modes:

Static: Manually configuring MAC addresses.
Dynamic: Automatically learning MAC addresses (without persistence).
Sticky: Dynamically learning and saving MAC addresses to the running configuration.

Port Security Violation Actions:

Protect: Drops traffic from unknown MAC addresses but does not increment the security violation counter or send SNMP traps.
Restrict: Drops traffic from unknown MAC addresses, increments the security violation counter, and sends SNMP traps.
Shutdown: Puts the port in an error-disabled state, requiring manual intervention to re-enable it.
Maximum MAC Addresses: Configuring the maximum number of MAC addresses allowed on a port.
Aging: Setting a timeout period for dynamically learned MAC addresses.
Configuration Commands: Familiarity with the Cisco IOS commands used to configure and verify port security, including:

switchport port-security

switchport port-security maximum [value]
switchport port-security mac-address [MAC_address] (for static configuration)
switchport port-security mac-address sticky
switchport port-security violation [protect | restrict | shutdown]
show port-security interface [interface]
show port-security address

Why is Sticky Learning Important for the CCNA 200-301 Exam?

The Cisco 200-301 exam emphasizes practical networking skills and the ability to implement fundamental security measures. Port security, including sticky learning, is a core concept that demonstrates your understanding of Layer 2 security and your ability to configure switches to prevent unauthorized access. Expect questions that test your knowledge of:

The purpose and benefits of sticky learning.
The configuration steps involved in enabling sticky learning.
The importance of saving the running configuration.
The different port security modes and violation actions.
Troubleshooting common port security issues.

Conclusion:

In conclusion, when configuring port security with sticky learning, the saving of the dynamically learned MAC addresses to the running configuration is a fundamental requirement. This ensures the persistence of the learned MAC addresses across switch reboots, maintaining the security posture of the network.