In this video, you and I get to both implement
and verify port security on a Layer-2 switch port.
Let's begin.
So for our plan of attack, let's do this.
Let's work with the access layer switch with its gig 00
interface that it happens to be where there's a computer.
It's actually Kali Linux box.
It's available to you in the lab.
And let's go to interface gig 00.
We'll do switch port mode access because we cannot use a dynamic
port.
Let's just say switch port access
VLAN 10 to make sure that's in the right VLAN
and switch port host.
In our lab environment, I need to do that one as well. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
In our lab environment, I need to do that one as well.
So it'll actually forced the switch port mode access.
It will also do the Portfast, which
be much better as far as balancing the port up and down.
So let's do all these three for this port.
And then we can do a show VLAN brief.
And the do command is because we're in configuration mode.
We need the do commands.
We can do our show commands.
So we'll do a show VLAN brief just to verify that gig 00 is
associated with VLAN 10.
We'll also do a show Mac address table for VLAN 10
to see how many are there.
And we have other commands like show port dash security WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And we have other commands like show port dash security
for a specific interface, and show port security in general.
And then this command right here is
what's going to implement it.
And I put all these up here because we may or may not
do them in the exact order.
But these are the commands that will
be very helpful as you and I discover,
verify, and then correct, if we need to,
any challenges that arise as a result of port security.
And you'll see what I mean in just a moment.
So let's go to the lab and let's go to the axis layer switch
and start working on interface gig 00. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and start working on interface gig 00.
So here in DC NUG, which is our management computer,
we'll open up PUTTY in the upper left hand corner
and we'll open up a connection to access 1, which
is our access layer switch.
And let's go to interface gig 0/0.
And we'll do a switch port mode access,
and switch port access VLAN 10.
And we'll also do a switch port host, which will also
enable Portfast on that port.
So the switchboard host is very convenient for the reasons WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So the switchboard host is very convenient for the reasons
we just talked about.
But also in this lab environment,
it's important to make the lab work.
So please include that when you do the lab, if you're
doing it on the virtual lab.
So let's verify a few things.
We'll do a show VLAN brief.
And sure enough, there's gig 00 assigned to VLAN 10.
That's great.
Let's also do a show Mac address.
Now, because we're in interface configuration mode,
it's not going to be really helpful very often
when context sensitive help.
So by knowing the command, you'd have
to actually type it out here. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
to actually type it out here.
So do show Mac address.
Dash table for VLAN 10.
Press Enter.
And the key is if you don't remember the syntax,
you could drop out of configuration mode
back to privilege mode, and then just
do the question marks to get the context sensitive
help along the way.
So here, I just want to verify how many Mac addresses were.
Currently, they're in by the switch associated with VLAN 10.
If we hit the up arrow key, we could also
add the interface gig 0/0 as a condition.
And that would show us just the Mac addresses associated with
VLAN just on gig 00. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
VLAN just on gig 00.
We have 3.
And there is our Kali Linux box from our previous video,
so that's great.
Now, currently if we do a show port security for interface gig
0/0, it's going to say it's disabled.
You don't have port security enabled on this interface.
But it is showing us that if we did enable it,
that the violation mode, if we exceeded
the maximum of Mac addresses, it would be shut down.
And also, here's the maximum number of Mac addresses.
However, because it's disabled, that feature
is not being used at the moment. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
is not being used at the moment.
So I want to point out something before we enable port security.
So the maximum number of learned Mac addresses
on the port, if we enable the feature as one
and if we go above one, we're going to go ahead
have a violation, which is going to shut down the port.
Look at this.
For VLAN 10, all off of gig 00 in the lab environment,
I see three different Mac addresses.
And that's, if I do the math on that, that's like too many.
So just be aware that if we enable port security,
which we're going to do, if we need port security and we have WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
which we're going to do, if we need port security and we have
more than just one device that sends a frame,
we're going to have a violation and a port can be shut down
because we currently have three Mac addresses that are hanging
off of that gig 00 that could speak at anytime.
One of the command is a show port dash security.
And that's just going to show us all of our interfaces.
So we have no interfaces that currently
have port security enabled.
And as a result, they're not showing up here.
So let's enable port security with the knowledge
that we're probably going to get a violation.
So we'll go ahead and we're still in interface config WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So we'll go ahead and we're still in interface config
for gig 00.
And the syntax is switch port space port security.
That's it.
And that'll take the defaults.
And it is now active.
So if we do a show port security, press Enter,
it now shows us that gig 00 is port security enabled.
The security action, that's the violation action, is shut down.
And the maximum Mac addresses that is willing to handle
is one on that port.
So the moment we have more than one Mac address who generates
a frame on gig 00, that the switch sees, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
a frame on gig 00, that the switch sees,
we're going to have a port security violation.
And if we don't want to wait for it, we don't have to.
So we go to our Kali Linux box.
And for the Kali Linux box, the user is root, R-O-O-T.
And the password is root backwards, which is T-O-O-R,
and press Enter.
And here on Kali Linux over on the left,
if we click on the icon to open a terminal,
it'll do that for us.
And from here, let's do a ping to 10.16.0.1,
which is just the switch virtual interface on Core One.
Yeah. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Yeah.
Check it out.
The reason that's not working is because I
guess the other Mac address from one other device
was already seen.
And now because Kali's trying to talk, he's being rejected
and that port has been shut down.
We can verify that by going back to the CLI.
All right.
So here, we have the port security violation
caused by Mac address.
It was.
The Mac address of the one from our Kali Linux box on gig 00.
And that interface is down.
Nobody is happy about that, as far as anybody
who is on that port before.
If we do a show interface status, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
If we do a show interface status,
space ERR dash disabled.
Press Enter.
That will show all of our ports that are err disabled and also
the reason.
So we have a port security violation,
which caused it to go down.
So in this video and lab, we've had the opportunity
to implement port security, and also
get a first hand seat looking at wow,
there goes the violation because we had more than the default
of one Mac address that showed up as a source address
on that port.
So in the next video, what I can do is talk with you
about some common tweaks that we're
likely to do in a production environment with port security WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
likely to do in a production environment with port security
so it helps us in protecting the network.
And at the same time, not causing a lot of overhead
imports going down unnecessarily.
So I'll see you in the next lab.
Meanwhile, I hope this has been informative for you
and I'd like to thank you for viewing.