In the previous video, we configured port security on Gigabit 00 by making the port an access port
and then enabling port security, Mac addresses were dynamically learnt.
So this Mac address was dynamically learnt on Port Gigabit 00 and hence
show port security
shows us that the address permitted on that port is this Mac address, it was dynamically learnt and
has been added to the database of permitted Mac addresses on the port.
Only one Mac address is allowed.
On gigabit 00 so max secured Mac addresses as one if a violation does take place, the security
action is to shut the port down.
Now, let's configure Mac addresses statically, so let's configure port security on gigabit 01
but do it manually.
So I'm going to use the commands, switch port, port security to specify maximum the default is 1.
So I'll say 1 here
and what you'll notice is the output is not shown because that is a default command on this interface.
But what we'll do now is type switch port
port security mac address and what I'll do is explicitly specify the Mac address that's allowed, and
just to prove the point, I'll specify a different Mac address of, let's say, 3.
Now at the moment
the Mac address on
this router acting as our PC, is this. So it's a different Mac address, the PC can still ping router
1 because we haven't explicitly enabled port security yet.
So we've configured what the Mac address is, we've configured the maximum Mac addresses allowed, I'll
specify
the action to take if there's a violation.
Notice we have protect, restrict and shut down the default, as we've seen the shutdown now protect
drops packets with unknown source MAC addresses until you remove a sufficient number of secure Mac addresses
to drop below the maximum value.
In other words, we are dropping packets from unknown source MAC addresses, but there's no logging at
the moment
we're only allowing one Mac address
but as an example, if you had specified a maximum Mac address of three and a fourth device, tried
to send traffic that to devices, traffic would be dropped, restrict drops packets with unknown source
MAC addresses until you remove a sufficient number of secure Mac addresses to drop below the maximum
value.
So that's very much the same as protect
but in addition, it causes the security violation counter to increment.
In other words, there's going to be the generation of log messages and counters will increment, shutdown
is the default which we've already seen, and that puts the port into error disable mode and sends an
SNMP trap notification if SNMP is configured.
So I'll continue to use shut down so that we can see the output, our configuration looks as follows.
Remember, the Mac address of this device is a different Mac address.
It's this, but we are only permitting this Mac address.
But because we haven't globally enabled port security, port security is not active.
So we can use the commands do show port security.
At the moment, port security is enabled on gigabit 00, but not on gigabit 01.
We can also use the command do show interface status at the moment, both Gigabit 00 and 01 are connected.
So port hasn't been shut down because of port security.
But now when we type switch port port security, we're actually enabling port security and once again,
we need to have this configured as an access port, can't use DTP.
So do show run interface gigabit 01
and while I was doing that notice, we received a port security violation message.
We were told that there was an issue
with this Mac address ending in 2 on gigabit 01, we have only permitted the Mac address ending
in 3 maximum Mac addresses that would be permitted are one, only one Mac addresses permitted in this
case when we look at the command.
Do show interface status, we can see that the port was error disabled, so show interface status is
a command that shows us the status of the ports.
We can see this is connected, but this port is error disabled.
So show port security once again shows us once again that gigabit 00 and 01 have a security action of
shut down, but the only port that's currently shut down is Port 01.
So show interface status shows us that this port is still connected, this port is error-disabled
and now this host can't ping router 1 because the port is error disabled.
Show Port Security Interface Gigabit 01.
We can see that port security is enabled on this port.
It's currently shut down because of the mode being shut down.
This is the last Mac address that violated the security policy on that interface.
So in router 2 if we change the Mac address to
the Mac address
expected by the switch.
It still won't be able to ping because of the violation that took place.
So we need to go into the
port and shut it down and then, no, shut it
and once that's done and the switch learns the correct Mac address.
The device should be able to ping, so at the moment, the Mac address hasn't been learnt.
Just waiting for the interface to come up.
So show interface status, let's see what's going on, interfaces connected
and now the ping succeeds.
I was just too impatient and I needed to wait for spanning tree and other protocols to sort themselves
out but show port security interface gigabit 01, we can see port security is enabled.
Violation mode is shut down.
At the moment, the port status is secure and the interface is up, last Mac address that was seen was
this on that port, no security violations occurred.
Maximum Mac address is once again allowed is one total Mac address is seen as one, one Mac address has
been configured because we manually configured the Mac address on the switch.
So if I save this configuration and the switch reboots, this Mac address is stored in the saved configuration.
So that's different to what we have on Gigabit 00 here when the switch reboots, it would simply learn
the source Mac address from a frame received.
So the first device that connects will have its Mac address added to the database to show port security
address, as an example, shows us the two addresses, this one was statically configured.
This one was dynamically learnt.
So the Mac address on this interface was configured.
This was dynamically learnt.
Now, the example on the right is where you explicitly allowing a specific Mac address onto the network.
The example on the left is where you are restricting the number of Mac addresses permitted on a port.
So on the left, you would stop a user connecting a hub as an example to the network and connecting
multiple devices to the port.
Whereas the example on the right is where we are limiting traffic to a specific MAC address.
The problem with this method is we are having to work out what the Mac addresses of the devices are
and then manually configuring those Mac addresses.
So let's look at another way of doing it.