4 months ago•9 minutes

Cisco and FortiSwitch Best Practices: Port Security, STP, and Access Policies

Perimeter and server security are essential, but your LAN access layer remains a critical attack and failure surface.

Whether you run legacy Cisco switches or modern FortiSwitch platforms, strong edge-port controls prevent loops, misuse, and unauthorized access.

1. Spanning Tree Protocol (STP): Prevent broadcast storms

Redundant links are necessary for availability, but poor cabling can create layer-2 loops that paralyze a site.

Enable Rapid PVST, PortFast, and BPDU Guard on user ports to protect the access layer from rogue mini-switches.

STP protection on user ports

Switch(config)# spanning-tree mode rapid-pvst
Switch(config)# interface GigabitEthernet1/0/1
Switch(config-if)# spanning-tree portfast
Switch(config-if)# spanning-tree bpduguard enable

2. Port Security: Lock physical access by MAC address

Port Security restricts a switch port to expected MAC behavior and blocks unauthorized devices.

Use sticky MAC learning with explicit violation policy to control edge connectivity without manual complexity.

Port Security baseline

Switch(config)# interface GigabitEthernet1/0/2
Switch(config-if)# switchport mode access
Switch(config-if)# switchport port-security
Switch(config-if)# switchport port-security maximum 1
Switch(config-if)# switchport port-security mac-address sticky
Switch(config-if)# switchport port-security violation restrict

3. Access control (802.1X) and RADIUS integration

At scale, move from MAC-based trust to identity-based access using 802.1X with AD-backed RADIUS.

With FortiGate/FortiSwitch integration, VLAN assignment and NAC decisions become dynamic and centrally managed.

Cisco RADIUS and 802.1X setup

Switch(config)# radius server NPS_AD_Server
Switch(config-radius-server)# address ipv4 192.168.10.10 auth-port 1812 acct-port 1813
Switch(config-radius-server)# key RadiusSharedSecret
Switch(config)# aaa new-model
Switch(config)# aaa authentication dot1x default group radius
Switch(config)# dot1x system-auth-control

FortiGate RADIUS declaration

config user radius
    edit "NPS_AD_Server"
        set server "192.168.10.10"
        set secret "RadiusSharedSecret"
    next
end

Final word

Are your access ports truly policy-driven and identity-aware?

Back to blog Contact our team