Like many people, I'm a big believer in security.
When I was a young father and our kids were really young,
one of the techniques that we discovered
was that you don't want the kids, the young kids,
like three and four years old, opening
the front door for people.
So to accomplish that goal, we had a lock
that used a key on both sides.
So there wasn't just a knob you could twist.
You'd have to have the key.
Now that's good for security because the kid without the key
can't accidentally or playing around open that door,
but it's a pain in the rear if there's somebody at the door WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
but it's a pain in the rear if there's somebody at the door
and you need to open it and you don't have the key handy.
It's an extra step.
So we have a similar thing going on
with port security violations.
Because if a port security violation puts
a port in error-disabled state and then it
takes a human like us to connect, log in, and do
a shut down and no shut down on the interface
to bring it back up, that's extra work.
If it happens two or three or four or five times a day,
even if it's accidental, it takes overhead
to get that corrected.
So wouldn't it be great if we could
have the switch look at port security violations WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
have the switch look at port security violations
that happen.
And if the port goes down, if it's shut down
because of a port security violation,
to wait a period of time, like 30 seconds or a few minutes,
and then bring it back up.
That's a good idea.
Now the great news is this-- if the system brings up the port
after a short time out, if whatever
was causing that port security violation is still going on,
there's too many MAC addresses, the switch will,
boom, put it back in shut down state,
then wait the time out again then bring it up.
So we're still protecting the network,
but we don't have to manually get involved WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
but we don't have to manually get involved
every time we want to bring a port back up out
of an error-disabled state if it was due to port security.
So what I'd like to do in the lab
is walk you through setting up that error recovery
automatically for port security violations.
And we'll do that in the lab right now.
So here we are in DC-NUG.
We'll open up a PuTTY session and we'll
go ahead and open a connection over
to access switch number one.
So I reset the lab.
So let's take a look at a few of the basics
before we start configuring.
We'll do a show VLAN brief.
That will help us verify whether or not gig 00 is in VLAN 10. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
That will help us verify whether or not gig 00 is in VLAN 10.
It is.
Fantastic.
Let's also issue the command show port security,
see if any ports on the switch are currently
configured for port security, and they're not.
So we'll go into configuration mode, interface gig 0/0,
and let's use the command switchport post.
And that's going to do a few things for us, including
confirming that we're not a dynamic port,
we're now an access port.
We already looked at the fact that this port is in VLAN 10.
And let's set a couple parameters for port security
before we enable the feature.
So we'll do a switchport port security, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So we'll do a switchport port security,
and let's set the max to--
let's go ahead and put in five.
That'll work.
And the default violation is going to be shut down,
and so we'll leave that alone.
And then we'll do switchport port security all by itself,
and this is the command that's going to enable the feature.
So if we do a show port-security for interface gig 0/0,
we can confirm that it's enabled.
So port-security is enabled.
The violation mode is going to be shutdown.
Maximum MAC addresses is five. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Maximum MAC addresses is five.
That all looks great.
So let's trigger a violation by going over
to our Kali Linux machine.
And here on the Kali Linux machine we'll log on as root
with the password of T-O-O-R, which is root backwards.
And we'll open up a terminal session.
And we'll use this icon over here to open up a terminal.
Fantabulous.
And let's go ahead and do a macof, space,
and we'll do a dash i for interface.
And I suppose we want to use Ethernet zero on this Kali WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And I suppose we want to use Ethernet zero on this Kali
Linux box, and then dash n for the number.
And let's just go ahead and let's do 20.
That's going to trigger it.
So we just sent 20 frames in all with spoofed and bogus source
MAC addresses.
And let's go take a look at our CLI on our admin PC.
So sure enough, there is our port security violation.
And now if we do a show interface status, space E-R-R,
and press Enter, it's going to show us
all the ports that are currently in an error-disabled state. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
all the ports that are currently in an error-disabled state.
And that includes gig 00, and it also shows the reason for it.
So I'm going to get out of configuration mode,
and let's do this.
Let's do a show error-disabled recovery.
Just like that.
And that command right there, I'll
highlight it, show error-disabled recovery,
is going to show us whether or not
we have auto recovery regarding error-disabled ports based
on the reason they went into an error-disabled state.
And right here, this guy right here, psecure violation,
is port security, and the automatic recovery WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
is port security, and the automatic recovery
has been disabled for it as is by default
for all of these other reasons.
So what we could do is we could just tell the switch,
hey, listen.
If there's a port security violation and that's
why it's in their disabled state, let's go ahead
and have you, after a short time out, bring it back up.
So to do that, we'll go to configuration mode.
And in configuration we'll use the command errdisable recovery
cause, and then we'll specify p.
And p is not unique, because there's
a few things that start with p, so we'll do a question mark.
And there is psecure violation. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And there is psecure violation.
There you go.
We can tab that out.
We can also specify how long we want
the timeout to be before it recovers
or brings that port back up.
So if we use the command errdisable recovery again
and interval, we can go ahead and specify how many seconds.
And so the range is 30 to 86,400 seconds, which is a full day.
So if we wanted it to be 30 seconds,
we can put 30 in there, press Enter.
And then if we use the show command for show errdisable
recovery, now the recovery is enabled
if a port is in error-disabled state based on a port security WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
if a port is in error-disabled state based on a port security
violation.
And this is also showing how much time is left.
Now this is showing 281 seconds left,
and that's because this happened before I
modified the timer to 30.
So from this point going forward the new violation
will only take 30 seconds.
So we can actually force that.
Let's go ahead and go into interface for gig 0/0,
and I'll take off that nine there.
00, there we go.
We'll do a shutdown and a no shutdown.
That's going to remove the error-disabled state
so the port's up and happy, happy. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
so the port's up and happy, happy.
Let's go back to our Kali Linux box and what we'll do
is we'll just trigger it again.
So from Kali Linux we'll just send 20 more in.
That should trigger a new port security
violation, which it just did.
Fantastic.
And now if we use the command show errdisable recovery,
we press Enter, we can see here the psecure violation
is enabled, so it's going to auto recover that for us.
But check this out.
If we hit the spacebar it's now showing us
how many seconds we have left.
So in 20 seconds it's going to bring that port back up WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So in 20 seconds it's going to bring that port back up
automatically by itself.
And if whoever's playing shenanigans off of gig 00
continues to play those shenanigans,
it would cause the port to go into error-disabled state again
based on yet another port security violation.
So if we hit the up arrow key and hit spacebar,
there's two seconds left.
It's going to be fantastic.
And there's our console message.
And now the interface is up.
And if you do a show interface status and then E-R-R and hit WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And if you do a show interface status and then E-R-R and hit
Tab, now we currently don't have any ports in an error-disabled
state because gig 00 was brought up automagically with
error-disabled recovery.
So this video, we've had the opportunity
to practice once again with implementing port security,
and then in addition taking a look at how we can set up
error-disabled recovery automatically
after a period of time for ports that were brought down because
of a port security violation.
So thanks for joining me in this video and lab,
and I'll see you in the next one.
Meanwhile, I hope this has been informative for you WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Meanwhile, I hope this has been informative for you
and I'd like to thank you for viewing.