In this video, we're going to discuss port security, which is used to provide a level of authentication
in an Ethernet environment. In a wired Ethernet environment, as an example, there's nothing stopping
you, simply plugging in your PC into any open port in the network.
So as an example, there's nothing stopping a user connecting their PC to a port in a director's office,
which then results in them having access to the directors VLAN.
There's also nothing stopping a user connecting a wireless access point to the network and allowing
multiple users to access the wired network through that wireless access point.
That's a major security risk.
What port security does is it looks at the source Mac address of frames received on a port and you can
restrict the frames allowed on a specific port to either a single Mac address that you configure or
to a a limited number of Mac addresses that are dynamically learnt their various options, which we'll
discuss.
But as an example, you could say on the port that connects to the director's office, only the Mac
address associated with their laptop or their PC is allowed to send frames to the switch and therefore
belong to the directors VLAN
or you could limit the number of Mac addresses allowed on a port.
As an example, you could limit the number of Mac addresses to one which would only allow a single PC
to access the network through that port.
Or if you have a PC connected to an IP phone, you may limit the Mac addresses to three, two for the
IP phone and one for the PC attached to the IP phone.
That would stop a user connecting an access point or a hub to the network and allowing multiple unauthorized
devices access to the Ethernet network.
Please note, this is not a user authentication.
User authentication can be implemented using 802.1x.
This is a more basic authentication based on MAC addresses, so only frames from specific MAC addresses
are allowed or a limited number of Mac addresses are permitted on a port on a switch that solves the
issue of a user connecting to a port that they're not authorized to connect to, or stopping a user
connecting a hub or wireless access point to the network and therefore allowing unauthorized access
to the network.
You can decide what happens when there's a violation of port security, you could simply drop the frames
or you could shut the port down using what's called an error disabled state in the most secure implementation
where you ever disable the port, you as an administrator have to manually re-enable the port.
So the user would have to contact the helpdesk as an example and explain that they no longer have access
to the network
and then you could investigate what happened and you'd be able to see if an unauthorized MAC address
or group of Mac addresses have tried to access the network through that port.
Port security is one of multiple security mechanisms that you can implement in a network, security
is kind of like a castle of old has shown here.
The idea is, is that you have multiple security mechanisms that involve themselves, don't provide
total security, but each a layer of security or each mechanism adds another level of security.
So in this example, you'd have to get across the sea to get to the castle, then you'd have to scale
the outer wall and you're still not at the core of the castle.
You'd have to climb up this hill and then scale the inner wall to be able to get to the king in the
castle as an example.
So in security, you implement multiple walls or mechanisms to make it harder for a hacker to attack
your network.
This also applies to users who inadvertently or without being malicious, do something that they shouldn't
on your network.
So port security isn't a catch-all security mechanism, it's just one of many and provides a basic or
entry level security mechanism to your network.
Ethernet once again has no security built into it.
A user could simply plug a laptop into your network and gain full access to the network.
Now, there's several ways that Mac addresses can be learnt.
The first is static, where you statically configure specific Mac addresses that are allowed or permitted
on a port.
Any Mac addresses that you don't specify are not allowed on the port.
The advantage with this method is that you have a lot of control, but the disadvantage is that you
have to manually work out what the Mac addresses are of all your devices and then manually configure
them.
You could also use dynamic learning where you specify how many Mac addresses are permitted on a port
and they are dynamically learnt.
So as an example, you could say that only two Mac addresses are permitted on a port and the first two
Mac addresses that are learnt are permitted.
Any subsequent Mac addresses are not permitted.
You would use this as an example to limit the Mac addresses permitted, but not to which Mac addresses
are permitted.
So you're limiting the number of Mac addresses and not limiting based on specific MAC addresses.
The thing to remember about dynamic learning is that when the switch is rebooted or the port goes down,
the Mac address has learnt or removed and new Mac addresses would then be permitted when the port comes
up again.
You could also specify aging interval to allow Mac addresses to be forgotten after a period of time.
So if you had a situation where you had a hot desk or a boardroom, you may only allow a certain number
of Mac addresses on a port
but those Mac addresses can change over time.
You could also do a combination of static and dynamic learning where you explicitly permit certain Mac
addresses.
So as an example, you could limit the number of Mac addresses on a port to four, but only statically
configured two Mac addresses.
The remaining two Mac addresses can be dynamically learnt.
The static Mac addresses do not age out, but you could allow it dynamically learnt Mac addresses to
agent Sticky learning allows you to automatically add a Mac address to the running configuration of
the switch.
So rather than statically configuring Mac addresses, you could allow the switch to learn Mac addresses
and then add them to the configuration.
When you save your running configuration to start up configuration, those Mac addresses will be kept
in NVRam and therefore won't be lost if the switch reboots.
So there are various options.
Remember, port security is an initial way to implement security.
It allows you to limit the number of Mac addresses permitted on a port and it allows you to specify
which Mac addresses are permitted on a port.
You have the option of just committing to Mac addresses on a port, but not worrying what those Mac
addresses are.
That would stop a user bringing a access point to home router to work and plugging it into the network
and allowing their friends to access the network.
Or you could be stricter and only allow specific Mac addresses on a port so a user can't connect to
a director's port and therefore have access to the director's VLAN.