So let's enable port security on this network, on the switch
we don't have any port security currently enabled, so no port security has been configured on gigabit
101.
We've been told to enable port security under that port with a single command.
So CONFT interface gigabit 101 switch port.
Look at the options available to us.
We've got this option.
Port security, port security, enter.
Notice what we're told
this is a dynamic port.
So we've got to firstly type switch port mode access to make the port and access port
and then we can enter our single port security command.
What we'll do, actually, is just name the switch, switch 1
per the diagram.
So now show port security enter, we can see that port security has been enabled on this port gigabit
101.
We can also see that the maximum Mac address count is 1.
In other words, only one Mac address is permitted.
What is the action? The action is to shut the port down so when a second host sends traffic onto the
network
the port should be shut down. If we look at the interface so gigabit 101
at the moment, we can see that this command shows us that port security is enabled, the status is
secure up, violation mode is shut down.
Maximum number of Mac addresses is 1.
Look at addresses.
No addresses have been learnt at the moment.
So what I'll do is send traffic from PC 1, I'll do an IP config slash renew.
PC has received an IP address again.
On the switch, show port security address notice, we've now learned about this address, it was dynamically
configured on this port gigabit 101 that wasn't shown previously.
Look at this interface, gigabit 101 port security is enabled.
We've now learnt this Mac address, maximum
number of Mac addresses allowed is 1 total Mac addresses is 1.
Previously, we hadn't learnt about that Mac address, so last source Mac address was blank.
0 total Mac addresses were learnt, so that looks good.
Show port security again, maximum Mac addresses allowed on this port is 1 current Mac addresses is
1.
So let's see what happens when we use IP config slash renew on PC 2.
On the switch, we see some output.
We can see that the interface was changed to down notice the DHCP request failed.
In packet tracer, we can see that the interfaces have gone red
and we're told that once again, the interface has gone down, so show port security, we can see that
a violation took place, action is to shut the port down and that's what happened.
If you look at the interface, this is the last Mac address that we saw.
A violation took place because we went over the maximum number of Mac addresses permitted.
Notice the port status is secure, shut down to show IP interface brief.
This port is being shut down
because
of the violation that took place and the fact
that the action is shut down. So again, maximum Mac addresses allowed on this port is one violation
took place,
action is to shut the port down.
So the port is being securely shut down because the violation mode is shut down.
Again, that's because PC 2 sent traffic into the network.
So by default, how many Mac addresses are permitted?
1 is the answer, verify that only the first host is allowed.
That's what we verified.
Now, what happens when the second host sends traffic?
The port is shut down, is the first host Mac address written to the running configuration?
The answer is no, show run
shows us that port security is enabled on this port, but we don't see the Mac address of PC 1, show
mac address table will show us Mac addresses that the switch learns when interfaces are up
but the Mac address is not written to the running configuration.
So if I go back onto that interface and no, shut the port
that port should go up
unless there's a security violation that took place.
No shut the port, so I'll shut it down first, actually, and then no shut it.
Notice it's now come up.
So I had to shut it and then no shut it.
Don't forget to shut and then no shut the port to re-enable it.
So show Mac, address table, what we should see is we should see the switch or learn the Mac address
of PC 1.
Notice its learned the Mac address of PC 1 on gigabit 101.
Port is up, show port security
current Mac address is 1.
Maximum Mac addresses allowed is 1 show run again shows us that the Mac address is not written to
the running configuration.
So if I save the configuration and then reload the switch.
What can happen is that a different Mac address could be learnt, so I'll set both PC 1 and PC 2
to use static IP addresses rather than dynamic IP addresses
and what you'll see happen is that
the Mac address can change under that port because it's not written to the running configuration, so
current addresses 0, maximum allowed is 1.
If we look at that interface, no Mac address has been learnt.
So now if I set PC 2 to DHCP, what happens is this Mac address is learnt .
So in other words, a different PC was able to send traffic into the network.
The limit is still only one PC, but a different PCs Mac address was learnt.
So show Mac address table shows us that PC 2s Mac address was learnt on this interface.
It's not written to the running configuration but
the problem with that is that we're not specifying which Mac addresses are allowed to send traffic.
We're only limiting the number of Mac addresses on the interface.
So if PC 1 now started using DHCP and sent a message into the network, notice the port goes down.
Mac addresses are not shown.
Show port security shows us that a violation took place because on this interface, this Mac address is
now seen as a violating Mac address.
Only one Mac address is allowed, but we're not specifying what that Mac address is.
So in other words, what happens when the switch is power cycled a different Mac address could be learnt.
We are not restricting Mac addresses on the port.
We are only restricting the number of Mac addresses allowed on that port.
But anyone could plug a PC into that port as long as they're the first PC that the switch learns.
If the switch reboots, a different Mac address could be launched on that port and the original Mac
address could be seen as a violating Mac address.