So on gigabit 104 show run, at the moment, we don't have any configuration on that port.
Interface Gigabit 104.
Once again, you have to make the port an access port before you enable port security.
So switch port mode access.
Switch Port port security.
Switch port Mac address.
And we need to specify the Mac address manually here.
So I'm going to specify it as
this Mac address, I know that because
that is the Mac address configured on this PC.
We can see that again by using IP config slash all.
That is the Mac address of PC 5.
So what have we done, we've configured this port with port security and we've manually configured this
Mac address per these instructions.
But notice, what we've been told to do is drop other traffic and send a log messages when a violation
occurs.
By default of that port will be shut down when a violation occurs.
So I need to change that
to say violation.
We have three options protect, restrict, and shut down.
The one that we want to use is restrict.
On Cisco's website, we told the differences protect drops packets with unknown source Mac addresses
until you remove a sufficient number of secure Mac addresses to drop below the maximum value.
Restrict does something very similar, but also causes the security violation counter to increment
so you can get a logging of what's taken place.
Shut down changes the port to error, disabled mode, error, disabled state and sends a SNMP trap notification.
Notice
this is different to a simple shutdown of the port.
The port is error disabled, so it will be shut down, but it's not simply administratively shut down
port.
So show run gigabit 104.
We've configured it for port security violation, restrict Mac address is this.
So show port security, we can see restrict here.
We can see that one Mac address has been learnt on this port.
Maximum is one security violation is restrict show port security interface gigabit 104.
No violations have occurred.
So let's cause that to happen.
PC 6 IP config slash all.
Is that let's do a review, rather, that should cause a violation.
On the switch now we can see that this command shows us that a violation took place, security violation
count is two maximum Mac address is one total Mac addresses is one configured
mac address is one.
The port is still enabled and it's still secure
but the violation counters are going up.
So notice the difference interfaces green, not red.
Even though we see the violations, three violations have occurred on this port, port hasn't been shut
down, though, because
we are using restricted mode.
This address is allowed on this port
it was manually configured, this address was learnt dynamically, but added to the running configuration
because of the sticky command.
So notice the difference with this method, you don't have to manually configure Mac addresses this
way, you'd have to find out the Mac addresses of your devices and manually add them.
Default mode is to shut the port down.
Restrict doesn't shut the port down, but you do get logging information.
Protect simply drops violating packets but doesn't log that information here.
We dropping violating frames but logging that information.
So here are three examples of how to set up port security.
Next thing we need to do is increase the number of devices allowed on gigabit 101 to 2.
So show run,
this port by default only allows one Mac address, so let's say switch port port-security, maximum
Mac addresses allowed is two, so I'll shut the port down and no shut it to re-enable it.
So show port security
two Mac addresses are now allowed on this port, currently, none have been learnt on that port.
We haven't learnt any Mac addresses, so let's generate some traffic,
IP config slash renew on PC1
on PC 2
IP config slash renew.
On the switch show, port security interface gigabit 101, we've now learnt about two Mac addresses.
The last one that we learnt was this one, there have been no violations.
So back on PC 1, if I send a renew again.
Last a Mac address learnt is now PC one, but again, there have been no violations, so show Port Security,
two Mac addresses have been learnt on this port out of a maximum of two, show port security interface
gigabit 101 again shows us that the port is up
and if we look at addresses
we've learnt about two addresses on gigabit 101 that however, is not written to the running
config.
So those Mac addresses are not written here.
If the switch rebooted, new devices could send traffic
But at this point, while the switch knows about those Mac addresses, if we change the Mac address
of this PC to something like this
and then send a DHCP request, what we should see is that the port goes down and there you go, it went
down.
Show port security address, we don't see those Mac addresses because the port has been shut down,
interface gigabit 101 last Mac address learned was this.
It's a security violation.
Port has been shut down.
The problem with shutting a port down is that you have to manually go and shut and then no shut the
port to re-enable it.
Whereas if you use restricted mode, the port is not shut down, but violating traffic is dropped.
You could use shutdown to force the users to, for instance, contact you to re-enable the port
and then you can ask them what happened and why they plugging in devices into the network that they
shouldn't.
Whereas with restrict you simply blocking them, you're not having to manually go and re-enable ports.
Okay, so how did you do?
Were you able to configure port security in the lab?
Do you understand all the different options in port security?
You need to understand port security for the CCNA exam.