In the previous video and lab, we enabled port security,
and boom right away got a port security violation
because the default for the maximum number
of Mac addresses on that port to be learned is just one.
So in this video and lab, we'll take a look
at some customization and tweaking for port security
that can make him more agreeable and survivable
in a production environment.
So I have reset the lab, and here's what I propose we do.
Let's go through the steps of making
sure we're not a dynamic port.
So these two to make sure it's an access port not
dynamically negotiated, also the switch port host WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
dynamically negotiated, also the switch port host
for the benefit of spanning tree and Portfast.
And also for the lab for this to work correctly,
please use that as well.
So we did those in the previous video.
Now for the new commands, we have
a switchport, port security, maximum.
So instead of saying hey maximum number of source Mac addresses
on this gig 0/0 port, let's go ahead and set it
to a number that's something a little more reasonable.
Because you might have devices, or virtual devices,
that have two or three Mac addresses on that port.
And so I think five, or whatever your company WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And so I think five, or whatever your company
thinks is a reasonable number, is
going to help in not having violations or alerts
when there's not a real problem.
We can also-- if we know that Bob's computer off gig 0/0
is a specific Mac address, we can
code it with switchboard port security Mac address
and put in that layer 212 hexidecimal character address.
And that will guarantee that Bob is
going to be one of those five that's going to be allowed.
Another option is we can plug-in Bob's computer
and use this command, switchport port security, Mac address,
sticky.
And what that does, it takes the Mac addresses WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And what that does, it takes the Mac addresses
that are learned on that port dynamically,
and it puts it in the running config.
So once those Mac addresses have been learned, we can do a copy,
run, start.
And then they'll be the startup config as well.
So the sticky option is a creative way
of dynamically learning an address
and getting it into the running config without having
to manually configure it.
And then based on your policy at your company,
you can decide what you want the violation response to be.
In this case, if we go above five Mac addresses--
a sixth Mac address shows up--
the default violation is to shut down the port.
But we may not want to shut down the port. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
But we may not want to shut down the port.
Maybe we just want to restrict any Mac addresses
above those five from being able to forward traffic.
So both the restrict and protect options do that.
And the restrict, if used instead
of to protect and restrict, also add some additional logging
capabilities.
It also increments the port security hit counter
for violations when it occurs.
So here's what I propose we do.
Let's implement this back on gig 0/0.
And for shut down, let's leave the default violation action
as shutdown.
Because if we set it to five and we only WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Because if we set it to five and we only
have three Mac addresses coming in off that port,
it won't hit the violation unless there's
some funny business going on.
And in that case, we would want the port possibly
to shut down, so that we can stop and investigate and find
out what's going on.
So in the hands on lab, it's good for our admin
PC which is DCNUG.
We'll open up PuTTy We'll go to the access layer
switch on gig 0/0.
And let's implement these commands.
So here on DCNUG, we'll open up empty PuTTy.
And then next, we'll grab the Servers tab
and open up Access 1. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and open up Access 1.
So we'll go to Configuration mode, interface gig 0/0.
And we'll switch port access vlan 10.
And switch port mode access, great.
And then also switch port hosts, which
will do these switch port mode access for us
but also enables Portfast as well.
And in the lab, it's required to make it work.
All right.
So looking at it, notice that's the first three steps.
Next, let's change the maximum number of Mac addresses.
Instead of being one, we'll change it to five.
So switchport, port security, maximum of five. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So switchport, port security, maximum of five.
Press Enter.
I also want you to note that we have not yet
enabled the feature of port security on this interface.
We're making all these changes regarding port security,
but it's not actually enabled until we use the command
switchport, port-security all by itself and press Enter.
And that's the moment port security
is going to be enabled on this interface.
Next, let's manually configure a Mac address
that we want port security to be aware of on this port.
So the syntax is switchport, port security, Mac address, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So the syntax is switchport, port security, Mac address,
and then the syntax.
If use a question mark, it'll tell us the syntax.
And now it's giving us the format
it wants us to put in, the 48-bit Mac address.
So we're going to use one 1122, a period, 3344,
a period, and a 5566, because that's the format they're
asking for, and press Enter.
Oh ho, ho, ho, ho, ho, ho, ho, ho.
It doesn't like that because of the first bits of that Mac
address.
Let's take a look at my notes.
Oh, yeah, yeah.
OK so we'll use 0/0. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
OK so we'll use 0/0.
So there are some rules in the first several bits of the Mac
address, and I broke this rule.
So I hit the upper key.
And we'll change the first two numbers to 0/0.
That should make it happy, happy.
There you go.
All right.
Next, let's go ahead and add the sticky command.
So dynamically, we learned Mac addresses will be
placed in the running config.
So they've been switch port, port security, Mac address,
and the keyword sticky, and press Enter.
And for the violation, let's leave the violation as
shut down, to shut down the port if we go over five. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
shut down, to shut down the port if we go over five.
Now as I mentioned, the very important aspect we need to do
is to enable this.
So if we did a do show port security right now,
you'll notice that port security is not
enabled on any interfaces including this gig 0/0,
because we have to use this command, switchport,
port security, and press Enter.
Boom.
And that enables it.
So if we use the upper arrow key a couple of times
and do a show port security, now we can see that gig 0/0,
has it enabled.
The maximum Mac addresses is five.
Currently, it knows about one, and the security action WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Currently, it knows about one, and the security action
is shut down.
We can also do a do show port security.
And it's not helping me because I'm in interface configuration
mode.
So in context sense, it'll help us out.
But do show port security for interface gig 0/0
is the command.
We'll press Enter.
And that's showing us the details for gig 0/0.
So it's enabled, the violation is shut down if it happens.
And currently look at that.
We're up to two Mac address.
Great.
Up to a maximum of five.
It also shows that we have one configured Mac address and one
sticky Mac address. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
sticky Mac address.
Fantastic.
So let's exit out of configuration mode.
And let's do a show Mac address table for interface gig 0/0.
All right.
So we've got three Mac addresses.
And now that we're willing to support five Mac addresses,
let's go generate a failure by going to our Kali Linux box.
And on the Kali Linux box, we'll log in as root.
The password is T-O-O-R, which is root backwards.
And we'll open up a terminal.
So we'll open up a terminal by clicking the icon for that
over here on the left. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
over here on the left.
In here, let's do a ping to 10.16.0.1 just
to verify connectivity.
That's great.
No problem there.
That's the vlan 10 layer 3 interface of core one
that we just pinged.
And we're going to ping core 2's vlan 10 layer 3 interface.
We could put its IP address in and ping it.
That's great.
And I'll do a Control C to stop that as well.
And if you go back to DCNUG, to our admin PC, and to the CLI
the access layer switch, hit the upper arrow key,
you'll notice we now have some additional Mac addresses,
including we have the Mac address for our Kali Linux Box
right there. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
right there.
So we're still under the window for port security, which
is a maximum of five for that port.
So let's go back to the Kali Linux box.
And at that the command line, let's do a macof.
We go a cam table overflow attack.
And we'll do a dash I for interface.
And the interface we want to use is
eth0 for ethernet zero space.
And for the number, let's just send in '10.
Let's not get too crazy.
So we'll do a -n, space, '10.
Press Enter.
And it sent those 10n.
If you go back to DCNUG, I'm expecting that we WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
If you go back to DCNUG, I'm expecting that we
have a port security violation.
Here it is.
And it's caused by that Mac address.
That must mean the sixth one as seen
by the switch on that port.
And as a result, the interface is now set to down.
And if we do a show interface status, and then error disable,
enter, that'll show us all the interfaces
that are currently in an error disable state
and also what caused it.
So 0/0 is error disabled due to ports curfew violation.
And there it stays.
And so that the port sits in error disabled state. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And so that the port sits in error disabled state.
Now it's a bummer because this requires by default manual
intervention.
We've got to go in.
We've got to shut down the port.
We've got to do a no shut to bring it back up.
And then that port can start working again.
But the moment that port security violation
happens again, it's going to shut down the port.
So let's solve that problem now by doing a shut and no shut
for that gig 0/0 interface, which will clear the air
and bring the port up.
So to do that, we're going to interface configuration mode
for interface gig 0/0.
And we'll do a shutdown.
And then we'll do a no shutdown. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And then we'll do a no shutdown.
And then if he has the upper command
a few times to show interface status for error disabled,
it's no longer error disabled.
And also if we go back to the Kali Linux box,
and instead of doing some crazy Mac off attack,
we just do a simple ping again, our traffic
can once again be able to go through.
So now that that switch port is up and running again,
if there is another port security violation--
meaning going above the five number mark for source Mac
addresses--
it was at that port down again. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
it was at that port down again.
In the next video, what I'd like to do
is walk you through an automated method
where we can train the switch, hey,
if there's a port security violation, wait 30 seconds,
and then bring it back up.
And then if there's another violation, bring it down.
And that way, we can have it-- like after the short time out--
bring up a port automatically from a shutdown state
if there's a port security violation.
At the same time, we can look at our logs,
get the messages that it's happening,
and we can research it.
But it means we don't have to come in at 2:00 AM
in the morning or some other inconvenient time WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
in the morning or some other inconvenient time
to manually bring a port out of an error disabled state.
So we'll cover all that in the next video.
Meanwhile, I hope this has been informative for you,
and I'd like to thank you for viewing.