Well, my friend, it is that time.
You may be saying, Keith, what do you mean that time?
It is time to apply our skills that we have practiced
and worked up to with port security
to the production network.
So to do that, we've got a call from Bob.
We're meeting him in his office.
And here is what he'd like to do.
And he'd like our help.
And my question for you is, are you in?
Awesome.
Let's go talk to Bob.
So we meet with Bob, and here's what he asks us.
He says, first of all, is it possible to go ahead and do
port security to limit the number of MAC addresses learned WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
port security to limit the number of MAC addresses learned
on an interface on a switch, even if it's a trunk interface?
And so we tell him, here's how it works.
To use port security, we just cannot--
I repeat not-- have a dynamic port.
We have to specify.
You are an access port, switch port mode access.
Or you are a trunk port, switch port mode trunk.
So as long as we're hard-coding those configurations
as an access port or a trunk port,
we can use port security on either one of those layer 2
interface types.
So he says to us, great! WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So he says to us, great!
That's what we want to do.
We want to make sure that on this trunk link from core 1
up to the access layer switch, which is gig 1/0,
and on core 2, this trunk link, 2/2, up to the access layer
switch, we want to make sure that we're
enabling port security.
And if there's a violation, meaning we go to 2001
or higher, we want the port security violation action
to be protect, as in not shut down the trunk,
but just protect, and not allow any additional MAC addresses
above and beyond the 2,000.
So before we begin, we ask him a couple more questions. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So before we begin, we ask him a couple more questions.
We say, Bob, are those trunks specifically set up
as trunks with switchport mode trunks so they're not dynamic?
He says, yes, that's already in place.
So the logical order we should approach this in is setting up
the maximum MAC addresses to 2,000
before we enable the feature, because the default is 1.
That might be a problem.
And then the second thing we want to do
is also specify the violation action, which
is going to be to protect.
And that order absolutely matters,
because we want the 2,000 parameter for MAC addresses
and the violation action to be in place before we WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and the violation action to be in place before we
flip the switch--
pun intended-- we flip the switch
and do switchport port security to enable the feature
on those two interfaces.
So with that plan in place, let's take one more quick look
at our topology.
We'll go configure core 1 and core 2 respectively.
So just as a reminder, here's the ports we're after.
We can also verify that those are the ports that
lead up to this access layer switch
by doing a show CDP neighbor as well.
And that's a good idea.
So let's go to our admin computer.
And we'll get consoles to core 1 and core 2. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And we'll get consoles to core 1 and core 2.
And we'll start our configuration.
So we'll launch MTPuTTY, upper left-hand corner.
Go to Servers.
And we'll get a connection to core.
And we'll get one more connection to core 2.
Good to go.
So let's start on core 1.
Let's just verify our connections
with the show CDP neighbor.
So from core 1's perspective, our local interface, gig 1/0,
does indeed go up to access 1.
So that's correct.
And let's also do a show port security just
to make sure that before we start configuring it's not
already in place somewhere. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
already in place somewhere.
So we'll do a show port security.
Not enabled anywhere.
Great.
Let's go to interface configuration mode for gig 1/0.
So we'll go to interface gig 1/0.
And we'll do a switchport port security.
And we're not going to press Enter,
because if we did right now, we'd
be enabling port security with a maximum MAC address of 1.
And that would be a huge problem.
So we're going to specify max.
And then we'll put it in the number of 2,000, which
is what they're looking for.
Let's also do a switchport port security. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Let's also do a switchport port security.
And we'll specify the violation action,
which they asked for protect.
Great.
And then third thing we want to do
is enable it on the interface.
So we'll do a switchport port security.
Press Enter.
And now it's enabled.
Now we can verify our work.
Say show port security.
Press Enter.
Great.
Gig 1/0, the MAC address is 2,000.
And the security action of protect.
OK.
Let's do that same command, show port security,
for interface gig 1/0.
See the details specifically on that interface. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
See the details specifically on that interface.
Fantastic.
One trunk port down, one to go.
Let's go over to core 2.
So on core 2, we'll also do a show port security just
to make sure we know what we're starting with.
Great.
We'll also do a show CDP neighbor just
to make sure we're on the correct interface,
the correct trunk, which is 2/2.
Fantastic.
And we'll go into configuration mode and in interface gig 2/2,
and switchport port security space.
We'll specify the maximum number of MAC addresses of 2,000.
It didn't like that period at the end. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
It didn't like that period at the end.
And we'll specify the violation action.
So switchport port security violation
is going to be the action of protect.
Great.
And then we'll enable the feature
just by using the command switchport port security,
and pressing Enter.
Then we'll verify our work.
Show port security.
Great.
Gig 2/2, 2,000.
Wow, it has four MAC addresses at the moment in the lab.
Great.
The security action is protect.
And let's also do that same command again,
but we'll say interface gig 2/2.
Press Enter. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Press Enter.
And the number of MAC addresses is growing as it's dynamically
seeing more and more.
So in this lab and video we've applied our skills
of using port security to the trunk ports on core 1
and core 2 for their connectivity
up to the access layer switch.
And if you have done this lab with me, which I hope you have,
whether it's in our gear, or virtual lab somewhere else,
or physical hardware, or GNS3, or Packet Tracer,
if you've done this exercise, give yourself another 10 points
on our journey towards 100.
And that gamifies or makes it a little more fun WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And that gamifies or makes it a little more fun
as we build our skills that we can put
to use in production networks.
And that makes us, you and I, more valuable to our families,
to our friends, and to our employers.
So I've enjoyed having you on this journey
in this skill of port security.
And I'll see you in the very next video.
Meanwhile, I hope this has been informative for you.
And I'd like to thank you for viewing.