Examkin

Question

Difficulty: MediumLayer 2 Security Features (Port Security, DHCP Snooping, DAI)

An administrator configures port security on a Cisco Catalyst switch access interface using the command switchport port-security mac-address sticky. End devices connect to the port, and their MAC addresses are dynamically converted to sticky MAC addresses. Following a scheduled reload of the switch, the connected devices lose network connectivity. What is the root cause of this issue?

  1. The running configuration was not saved to the startup configuration after the sticky MAC addresses were learned.Answer
  2. B
    Sticky MAC addresses are stored strictly in volatile RAM and cannot be saved across switch reboots.
  3. C
    Port security automatically resets the violation mode to protect upon switch reboot, blocking all traffic.
  4. D
    Dynamic ARP Inspection rejected the frames because sticky MAC addresses must be manually entered into an ARP access control list.

Answer

The running configuration was not saved to the startup configuration after the sticky MAC addresses were learned.
When port security sticky learning is configured, dynamically learned MAC addresses are converted into sticky entries within the running configuration. Because the running configuration resides in volatile RAM, failing to save the running configuration to the startup configuration causes all learned sticky MAC entries to be lost when the switch reloads.

Step-by-Step Solution

1
Identify how sticky MAC address learning behaves in Cisco IOS port security.
When sticky learning is enabled via `switchport port-security mac-address sticky`, dynamically learned MAC addresses are automatically added to the active running configuration as static port security entries.
Sticky learning allows dynamic learning of MAC addresses while populating the running configuration so manual entry of MAC addresses is not required.
2
Evaluate the persistence of running configuration changes across device reloads.
The running configuration resides in RAM. If `copy running-config startup-config` is not issued before a reboot, all dynamically added sticky MAC entries are erased.
The switch reloads using the startup configuration stored in NVRAM, which does not contain the un-saved sticky MAC statements.

Key Concept

Port Security Sticky MAC Persistence
Rate this question

Topics

Layer 2 Security Features (Port Security, DHCP Snooping, DAI)

More questions from this topic