In this packet tracer lab, you need to configure port security, so what is port security and why is
it important?
Port security is one of the most basic ways to enable a level of security on wired switched networks.
Wired Ethernet networks don't have any security.
by default, a user could simply plug in their PC into any port in a switch and start sending and receiving
traffic. So port
security is a basic way to start implementing security on wired Ethernet infrastructures.
We can limit the number of Mac addresses on a port and we can specify exactly which Mac addresses
are permitted on specific ports.
In this example, users have plugged hubs into ports on a switch which allow them to connect multiple
devices to the network.
You need to stop that by enabling port security in this network.
In this lab, we have a single switch, switch
1
and it has multiple hubs connected to it, hub 1, 2 and hub 3, each hub has two PCs connected
to it.
We also have a DHCP server that's allocating IP addresses to hosts in the topology.
In this lab you need to configure port security as follows.
On gigabit 101 configure port security with a single command and then answer these questions.
By default, how many Mac addresses are permitted if you only use a single port security command on
that interface?
How many Mac addresses are permitted by default?
This kind of gives you the answer.
Verify that only the first host is allowed.
So don't just configure port security.
Verify that it works as you think it works.
What happens when the second host sends traffic into the network?
In other words, once you've got port security enabled, what happens when the first host sends messages?
What happens when the second host sends messages?
Is the first host Mac address written to the running configuration?
So in other words when you type show run on the switch
do you see the hosts Mac address in the running config?
And what happens when you power cycle the switch? Save the config first and then reboot the switch.
Is the original Mac address remembered or can a different host send traffic into the network when the
switch is rebooted?
So think about those questions with regards to a default configuration using port security.
Then on Port Gigabit 103 enable port security and automatically add the Mac address to the
running configuration of the first host that sends traffic.
So don't just enable port security and have the Mac address in the Mac address table and port security
database, but also have it added to the running configuration.
What happens when the second host sends traffic?
What happens when the switch is power cycled and you haven't saved the configuration?
So in the second example, ensure that the Mac address is shown in the running configuration reboot
the switch, but don't save the running configuration.
Will that Mac address be lost and can a different Mac address be written to the running configuration
when the switch is rebooted?
Then enable port security on gigabit 103 by manually specifying PC 5 MAC address.
So on PC 5, the device is configured with this Mac address.
You can also verify that by using the IP config special command.
And here you can see the Mac address of the PC enabled port security on this port by manually specifying
the Mac address of PC 5
but on this port, drop other traffic and send a log messages when a violation occurs.
Don't use the default behavior.
Drop traffic over the offending host and log messages.
Don't simply shut the port down and then increase the number of devices allowed on gigabit 10
1 to two devices and verify that both PCs can now send traffic and receive IP addresses from the DHCP
server.
At the moment, the switch doesn't have port security enabled on it, so show run shows us that the
switch has a basic configuration.
No configuration exists on these interfaces, so which has a very basic default config.
That means that PC such as PC 1
Will receive an IP address from the DHCP server and so will other devices such as PC 2.
Notice it's got IP address 10.111
but once you've got port security enabled on your switch, users won't be able to plug in hubs and simply
add additional devices to the network.
So can you complete the slap and answer these questions, do you know how to configure port security,
download the packet tracer file and see if you can complete the lab yourself.
Otherwise, watch the next video where I complete the lab.