In this video, you and I are going to do three basic things.
Number one, we'll take a look at how port security, this feature
is going to protect the network at the switch port level.
Two, we'll take a look at some of the prerequisites
for it to work.
And third, we'll take a look at some of its defaults.
That way, when we go to implement it,
we won't be surprised by any negative consequences,
because we can understand beforehand
what those defaults are and then we
can change them if we need to.
So let's imagine we have this switch right here.
And we have a port gig 0/0 that we want
to set up port security on. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
to set up port security on.
Some of the prerequisites for that port is that it cannot be
a dynamic layer two port.
If it is a dynamic layer two port,
meaning it will auto negotiate the port,
it will not allow that port to take on the port security
command.
So an easy fix for that in the port,
if this is an access port, we can switch port mode access
if you want it to be an access port.
Or switch port mode trunk if you want it to be a trunk port.
And another technique that often uses the command
switchport space host. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
switchport space host.
And what that does it forces it into access mode for the port.
It also turns on Portfast so that you don't have to wait,
or your users don't have to wait for the listening and learning
states for spanning tree when their computer is
connecting to the network.
So either way we do it, with switchport mode access,
directly, or switch port host, which inputs the switch port
mode access into the configuration,
it's important that that port is not a dynamic port.
And associated with that, we'd also
want to make sure this port was in the correct VLAN, so switch
port access VLAN 10, or whatever VLAN WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
port access VLAN 10, or whatever VLAN
we want that port to be in.
So that's our first prerequisite for getting the feature
of port security working.
Our next step to enable port security on this interface
would go into interface configuration mode
and use the command switchport, Space Port Security
and press Enter.
And at this point, one of three things typically happens.
If the switch and the version of software
doesn't support port security, of course, it won't take.
Or if this port is a dynamic port,
meaning it hasn't been hard coded WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
meaning it hasn't been hard coded
as an access or a trunk port.
We'll get a message saying, whoa, this is a dynamic port,
can't use the feature.
Or third, we press Enter and boom,
port security is in place on that port and away we go.
Now, it's important to know what the defaults are
for port security, and here they are.
Port security says, by default, that the maximum number of Mac
addresses that it will be willing to learn on
that port is one.
That's it.
And that's the big way of that port protecting the network
against multiple people trying to connect WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
against multiple people trying to connect
at the same time on that port.
So if Bob, who's using that port, connects the switch to it
and connects two or three other devices to it,
the switch is going to see more than one source Mac
address on that port, and that's going to cause a violation.
And the default port security violation is pretty severe.
It is shut down the port.
[MIMICKING ALARM SOUND]
Shut it down, shut it down, shut it down.
And the switch will actually shut down that port
and put it into a state called error disable, which
means there's no more traffic flow into that port.
They blew it. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
They blew it.
They have too many Mac addresses that showed up,
and port security says, I'm shutting you down.
So the default violation action for port security
is to shut down the port.
So with these defaults, if Bob tries to connect a switch
and connect multiple devices, boom, there's a violation,
port is shut down.
Or if a hacker connects and he's starting to spoof or lie
about lots of source Mac addresses
and it exceeds the default maximum
for port security, boom, that port is shut down
and that switch is protected against the cam table overflow
attack. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
attack.
And in addition, if we want to only allow specific Mac
addresses on this port, we can actually
train port security about which Mac addresses are allowed.
So we take Bob's computer, we get
Bob's computer Mac address configured
as being associated that port.
And any other device, other than that specific layer
two Mac address is a source address, won't be allowed.
Only Bob's computer has been configured.
And that's how port security, when
it's applied to layer two switch ports
can help protect our network.
And in the very next video, you and I will walk through a lab
where we'll implement and verify port security on a layer two WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
where we'll implement and verify port security on a layer two
interface.
So I'll see you there in just a moment.
Meanwhile, I hope this has been informative for you.
And I'd like to thank you for viewing.