So let's configure and test port security in this example, I've got GNS3 running iOS via layer
2 that is our switch in the topology and then I've got a Cisco iOS router.
It's a 3725 router image, which I'm using as the PCs in the topology.
So router 1 will activate PC 1 and router 2 will act as PC 2, we'll configure Mac addresses
on the routers and then change them to prove that port security works.
Mac addresses with a vendor code 002333 belong to Cisco Systems.
So we'll use this Mac address range so that we can see the output in Wireshark and create easy to read
Mac addresses in the lab, the routers and switch have booted up with no configuration.
So I've made no configuration changes on these devices.
Let's start off
by naming this device switch 1, router 1 is already configured and so is router 2 based on the default
configuration GNS3.
But the switch has no configuration, so at the moment, if we top show port security.
You'll notice that there's no output here because port security is not currently enabled.
Show, Mac, address table.
Shows that no Mac addresses have been learnt, so on router one, let's configure FastEthernet 00
with Mac address 0023
3300 0001 and I'll no shut that port.
We'll do something similar in router 2.
We'll just make this 2 rather than 1 and no, shut the port.
Show Mac address table shows us that the switch has learnt both these Mac addresses, so router 1 is
available on Gigabit 00, router 2 is available on gigabit 01.
Both addresses were learnt dynamically.
In other words, we don't statically configure these Mac addresses.
They have been dynamically learnt by the switch.
Show port-security still shows us that port security hasn't been enabled.
We have no output.
So going on to gigabit00, let's try and enable port security.
Notice the command is rejected
and that's because we're running dynamic trunking protocol or DTP on this port.
We haven't statically configured this port as an access port or as a trunk port.
So let's type switch port mode access and we'll enable port security again, the command is now accepted.
So show port-security shows us that the secure port is gigabit00 the maximum secure address is allowed
on the port is one by default, only a maximum of one Mac addresses allowed on a port security port.
How many Mac addresses have currently been learnt? Answer is one.
How many security violations have occurred? zero, and what security action will be taken if there's
a violation? The port will be shut down.
In other words, it will be error disabled.
We'll look at some of the other options in a moment, but let's see what happens.
Show port security, let's look at some options address.
So here's the secure Mac address table on VLAN 1, this Mac address has been learnt.
The type is secure, dynamic, we dynamically learnt about the address, the port is gigabit 00, the
remaining age is a hyphen.
You can determine how long a Mac address that is learnt is remembered before it's aged out on a port.
Now, notice, this example is not restricting this port to specific Mac addresses.
It's limiting the port to one Mac address.
We didn't statically configure the port, so show run interface gigabit 00 shows us that we enabled
port security and that's all we did.
We didn't statically configure a Mac address, but if we change the Mac address on this port to let's
say 3, let's see what happens.
As soon as the port came up, we get an error
disabled message port-security violation error detected on gigabit 00.
The port is now being put into error
disabled state, a security violation occurred caused by this Mac address notice ending in 3 on
Port Gigabit 00.
The line protocol has gone down, so show interface gigabit 00.
There's the command shows us that the port is down, down, and the reason for that is error disable the
port was error disabled port has gone down.
This router, and let's give it an IP address, will not be able to send traffic to this device.
So router 2 acting as PC2
because
the port is down show port security.
Please note, this is not to the status of the port.
This is the action that's taken when there's a violation show port security interface Gigabit 00 shows
us that port security is enabled on the port.
The status is secure, shut down, the violation mode is shut down.
This is the last Mac address that was seen on the port.
Only one Mac address is allowed.
The violation count is 1
and that's because the Mac address that's allowed on that port, which is not shown here because the
port has gone down, I'll just scroll up to show you the output.
Was this Mac address and we've changed the Mac address, so ending in triple zero one, is the Mac address that's
permitted but
this is the last Mac address that was seen that caused a violation.
So let's change the Mac address back to one and on this side, we'll go into the port and shut it down
and then wait for that
to go down and then no, shut it.
Show port
you can see that show port security before I press enter notice, the port has come up, so port has come up.
Secure mac address is 1 at the moment, it hasn't learnt to mac address, let's do a ping
to router 2.
As you can see now, it's now learnt a Mac address.
So now the ping succeed.
Show port security shows us that the max mac ddress allowed is one current address is one, so one has
been learnt.
Let's look at the interface again.
So gigabit 00
at the moment, there is no violation.
The port status is secure up.
The violation mode is to shut the port down, but currently the port is up, scrolling back up.
Previously noticed it was secure, shut it down based on the violation mode of shutdown, but now it's
go up because the correct Mac address has been learnt, which is this Mac address.
So notice, the first Mac address that was received was added to the list of permitted Mac addresses.
It was dynamically learnt.
So you would have to ensure that the right Mac address is received on the port if you reboot the switch
that information is lost.
So the first host that's connected to that port will be permitted.
and that may not be what you want.
You may want to explicitly permit only certain Mac addresses associated with certain machines.
So let's have a look at that.