The first step is to disable all unused ports using the shutdown command. Use interface range to configure multiple ports at once.

Why disable unused ports?

• Layer 2 attacks are easy to deploy — an attacker just needs physical access to an open port
• An unused port that's left enabled is an open invitation for unauthorized devices
• All ports should be secured before the switch is deployed for production use

Disabling a range of unused ports:

Switch(config)# interface range FastEthernet 0/8 - 24
Switch(config-if-range)# shutdown

Additional best practices for unused ports:

• Assign them to an unused "black hole" VLAN (Virtual Local Area Network): switchport access vlan 999
• Set them explicitly to access mode: switchport mode access
• This way, even if someone re-enables a port, it's in an isolated VLAN

Re-enabling a port later:

Switch(config)# interface FastEthernet 0/8
Switch(config-if)# no shutdown

Tip: In practice, "secure unused ports" almost always means: shutdown + assign to unused VLAN + set to access mode.

Go deeper:

• Securing Unused Ports (PivIT Global) — the layered practice: shutdown + access mode + black-hole VLAN, with interface-range examples.

Port security limits the number of valid MAC (Media Access Control) addresses allowed on a switch port. The port must be manually configured as an access port or trunk — port security cannot be enabled on a dynamic (default) port.

What port security does:

• Limits the number of source MAC addresses that can be learned on a port
• When a frame arrives, the source MAC is compared against the list of allowed (secure) MACs
• If the MAC is not in the list and the maximum has been reached → violation occurs

Prerequisite — the port cannot be dynamic:

S1(config-if)# switchport port-security
Command rejected: FastEthernet0/1 is a dynamic port.

S1(config-if)# switchport mode access          ! Must set access mode first!
S1(config-if)# switchport port-security         ! Now it works

Default port security settings after enabling:

Key insight: With defaults, enabling port security on a port means: only one MAC address is allowed, and if a second device connects, the port shuts down. This is already quite restrictive but effective.

Go deeper:

• MAC flooding (Wikipedia) — the CAM-overflow attack port security exists to stop.
• Switchport Port-Security (NetworkAcademy.IO) — concept-to-config overview tying learning and violation modes together.