An administrator configures port security on an enterprise access switch interface using the switchport port-security mac-address sticky command to restrict network access to authorized devices. Endpoints connect successfully and their hardware addresses are added to the active configuration as sticky entries. Following an unexpected power maintenance event, the switch reboots. When the authorized endpoints attempt to reconnect, port security violation alerts are triggered and traffic is blocked. Which administrative oversight caused this issue after the switch rebooted?
- The administrator failed to save the running configuration to the startup configuration after the sticky MAC addresses were learned.Answer
- BThe administrator failed to append an explicit permit statement to override the default interface port security implicit deny clause.
- CThe administrator selected TACACS+ authentication instead of RADIUS, which prevented local MAC address persistence across reboots.
- DThe administrator omitted the overload parameter when enabling port security on the physical switch interface.
Answer
The administrator failed to copy the running configuration containing the learned sticky MAC addresses to the startup configuration prior to the reboot.
The command switchport port-security mac-address sticky dynamically learns connected MAC addresses and converts them into sticky secure MAC address entries in the running configuration (stored in volatile RAM). If the administrator does not save the running configuration to the startup configuration (stored in NVRAM) using copy running-config startup-config or write memory, all learned MAC addresses are lost upon reboot. When the switch comes back online, its sticky MAC table is empty, causing returning authorized devices to be flagged as unknown/unauthorized and triggering security violations.
Step-by-Step Solution
Key Concept
Port Security Sticky MAC Address Persistence