WEBVTT

1
00:00.000 --> 00:00.390 align:middle line:84%


2
00:00.390 --> 00:02.890 align:middle line:90%
In this video, you and I are
going to do three basic things.

3
00:02.890 --> 00:06.180 align:middle line:90%
Number one, we'll take a look at
how port security, this feature

4
00:06.180 --> 00:08.615 align:middle line:90%
is going to protect the network
at the switch port level.

5
00:08.615 --> 00:10.740 align:middle line:90%
Two, we'll take a look at
some of the prerequisites

6
00:10.740 --> 00:11.730 align:middle line:84%
for it to work.

7
00:11.730 --> 00:14.130 align:middle line:90%
And third, we'll take a look
at some of its defaults.

8
00:14.130 --> 00:15.840 align:middle line:90%
That way, when we
go to implement it,

9
00:15.840 --> 00:19.380 align:middle line:90%
we won't be surprised by
any negative consequences,

10
00:19.380 --> 00:20.880 align:middle line:90%
because we can
understand beforehand

11
00:20.880 --> 00:22.530 align:middle line:90%
what those defaults
are and then we

12
00:22.530 --> 00:24.910 align:middle line:84%
can change them if we need to.

13
00:24.910 --> 00:27.040 align:middle line:90%
So let's imagine we have
this switch right here.

14
00:27.040 --> 00:29.820 align:middle line:90%
And we have a port
gig 0/0 that we want

15
00:29.820 --> 00:31.890 align:middle line:84%
to set up port security on.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

15
00:29.820 --> 00:31.890 align:middle line:84%
to set up port security on.

16
00:31.890 --> 00:34.860 align:middle line:90%
Some of the prerequisites for
that port is that it cannot be

17
00:34.860 --> 00:37.440 align:middle line:84%
a dynamic layer two port.

18
00:37.440 --> 00:39.090 align:middle line:90%
If it is a dynamic
layer two port,

19
00:39.090 --> 00:41.340 align:middle line:90%
meaning it will auto
negotiate the port,

20
00:41.340 --> 00:44.100 align:middle line:90%
it will not allow that port
to take on the port security

21
00:44.100 --> 00:44.880 align:middle line:84%
command.

22
00:44.880 --> 00:46.560 align:middle line:90%
So an easy fix for
that in the port,

23
00:46.560 --> 00:52.100 align:middle line:90%
if this is an access port, we
can switch port mode access

24
00:52.100 --> 00:53.810 align:middle line:90%
if you want it to
be an access port.

25
00:53.810 --> 00:56.360 align:middle line:90%
Or switch port mode trunk if
you want it to be a trunk port.

26
00:56.360 --> 00:58.640 align:middle line:90%
And another technique that
often uses the command

27
00:58.640 --> 01:01.560 align:middle line:84%
switchport space host.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

27
00:58.640 --> 01:01.560 align:middle line:84%
switchport space host.

28
01:01.560 --> 01:05.060 align:middle line:90%
And what that does it forces it
into access mode for the port.

29
01:05.060 --> 01:07.790 align:middle line:90%
It also turns on Portfast so
that you don't have to wait,

30
01:07.790 --> 01:10.415 align:middle line:90%
or your users don't have to wait
for the listening and learning

31
01:10.415 --> 01:12.650 align:middle line:90%
states for spanning tree
when their computer is

32
01:12.650 --> 01:14.383 align:middle line:84%
connecting to the network.

33
01:14.383 --> 01:16.550 align:middle line:90%
So either way we do it,
with switchport mode access,

34
01:16.550 --> 01:19.730 align:middle line:90%
directly, or switch port host,
which inputs the switch port

35
01:19.730 --> 01:22.040 align:middle line:90%
mode access into
the configuration,

36
01:22.040 --> 01:24.872 align:middle line:90%
it's important that that
port is not a dynamic port.

37
01:24.872 --> 01:26.330 align:middle line:90%
And associated with
that, we'd also

38
01:26.330 --> 01:29.270 align:middle line:90%
want to make sure this port was
in the correct VLAN, so switch

39
01:29.270 --> 01:34.480 align:middle line:90%
port access VLAN
10, or whatever VLAN
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

39
01:29.270 --> 01:34.480 align:middle line:90%
port access VLAN
10, or whatever VLAN

40
01:34.480 --> 01:35.980 align:middle line:84%
we want that port to be in.

41
01:35.980 --> 01:38.500 align:middle line:90%
So that's our first prerequisite
for getting the feature

42
01:38.500 --> 01:40.030 align:middle line:84%
of port security working.

43
01:40.030 --> 01:42.460 align:middle line:90%
Our next step to enable port
security on this interface

44
01:42.460 --> 01:44.210 align:middle line:90%
would go into interface
configuration mode

45
01:44.210 --> 01:47.910 align:middle line:90%
and use the command
switchport, Space Port Security

46
01:47.910 --> 01:48.835 align:middle line:84%
and press Enter.

47
01:48.835 --> 01:51.210 align:middle line:90%
And at this point, one of
three things typically happens.

48
01:51.210 --> 01:53.520 align:middle line:90%
If the switch and the
version of software

49
01:53.520 --> 01:56.370 align:middle line:90%
doesn't support port security,
of course, it won't take.

50
01:56.370 --> 01:58.655 align:middle line:90%
Or if this port
is a dynamic port,

51
01:58.655 --> 02:00.030 align:middle line:90%
meaning it hasn't
been hard coded
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

51
01:58.655 --> 02:00.030 align:middle line:90%
meaning it hasn't
been hard coded

52
02:00.030 --> 02:01.615 align:middle line:84%
as an access or a trunk port.

53
02:01.615 --> 02:03.990 align:middle line:90%
We'll get a message saying,
whoa, this is a dynamic port,

54
02:03.990 --> 02:05.100 align:middle line:84%
can't use the feature.

55
02:05.100 --> 02:07.650 align:middle line:90%
Or third, we press
Enter and boom,

56
02:07.650 --> 02:10.888 align:middle line:90%
port security is in place
on that port and away we go.

57
02:10.888 --> 02:12.930 align:middle line:90%
Now, it's important to
know what the defaults are

58
02:12.930 --> 02:15.060 align:middle line:90%
for port security,
and here they are.

59
02:15.060 --> 02:18.960 align:middle line:90%
Port security says, by default,
that the maximum number of Mac

60
02:18.960 --> 02:21.510 align:middle line:90%
addresses that it will
be willing to learn on

61
02:21.510 --> 02:24.450 align:middle line:84%
that port is one.

62
02:24.450 --> 02:25.740 align:middle line:84%
That's it.

63
02:25.740 --> 02:28.950 align:middle line:90%
And that's the big way of that
port protecting the network

64
02:28.950 --> 02:30.900 align:middle line:90%
against multiple people
trying to connect
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

64
02:28.950 --> 02:30.900 align:middle line:90%
against multiple people
trying to connect

65
02:30.900 --> 02:32.800 align:middle line:84%
at the same time on that port.

66
02:32.800 --> 02:35.550 align:middle line:90%
So if Bob, who's using that
port, connects the switch to it

67
02:35.550 --> 02:37.860 align:middle line:90%
and connects two or three
other devices to it,

68
02:37.860 --> 02:40.080 align:middle line:90%
the switch is going to see
more than one source Mac

69
02:40.080 --> 02:43.780 align:middle line:90%
address on that port, and that's
going to cause a violation.

70
02:43.780 --> 02:46.890 align:middle line:90%
And the default port security
violation is pretty severe.

71
02:46.890 --> 02:48.600 align:middle line:84%
It is shut down the port.

72
02:48.600 --> 02:50.070 align:middle line:84%
[MIMICKING ALARM SOUND]

73
02:50.070 --> 02:51.880 align:middle line:90%
Shut it down, shut it
down, shut it down.

74
02:51.880 --> 02:54.060 align:middle line:90%
And the switch will
actually shut down that port

75
02:54.060 --> 02:56.310 align:middle line:90%
and put it into a state
called error disable, which

76
02:56.310 --> 02:59.220 align:middle line:90%
means there's no more
traffic flow into that port.

77
02:59.220 --> 03:00.010 align:middle line:84%
They blew it.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

77
02:59.220 --> 03:00.010 align:middle line:84%
They blew it.

78
03:00.010 --> 03:02.010 align:middle line:90%
They have too many Mac
addresses that showed up,

79
03:02.010 --> 03:04.290 align:middle line:90%
and port security says,
I'm shutting you down.

80
03:04.290 --> 03:07.320 align:middle line:90%
So the default violation
action for port security

81
03:07.320 --> 03:11.360 align:middle line:84%
is to shut down the port.

82
03:11.360 --> 03:13.937 align:middle line:90%
So with these defaults, if
Bob tries to connect a switch

83
03:13.937 --> 03:16.270 align:middle line:90%
and connect multiple devices,
boom, there's a violation,

84
03:16.270 --> 03:17.530 align:middle line:84%
port is shut down.

85
03:17.530 --> 03:20.770 align:middle line:90%
Or if a hacker connects and
he's starting to spoof or lie

86
03:20.770 --> 03:22.630 align:middle line:90%
about lots of
source Mac addresses

87
03:22.630 --> 03:24.700 align:middle line:90%
and it exceeds the
default maximum

88
03:24.700 --> 03:27.010 align:middle line:90%
for port security, boom,
that port is shut down

89
03:27.010 --> 03:29.490 align:middle line:90%
and that switch is protected
against the cam table overflow

90
03:29.490 --> 03:30.280 align:middle line:84%
attack.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

90
03:29.490 --> 03:30.280 align:middle line:84%
attack.

91
03:30.280 --> 03:32.740 align:middle line:90%
And in addition, if we want
to only allow specific Mac

92
03:32.740 --> 03:34.365 align:middle line:90%
addresses on this
port, we can actually

93
03:34.365 --> 03:37.930 align:middle line:90%
train port security about which
Mac addresses are allowed.

94
03:37.930 --> 03:39.820 align:middle line:90%
So we take Bob's
computer, we get

95
03:39.820 --> 03:41.740 align:middle line:90%
Bob's computer Mac
address configured

96
03:41.740 --> 03:43.300 align:middle line:84%
as being associated that port.

97
03:43.300 --> 03:46.050 align:middle line:90%
And any other device, other
than that specific layer

98
03:46.050 --> 03:49.060 align:middle line:90%
two Mac address is a source
address, won't be allowed.

99
03:49.060 --> 03:51.693 align:middle line:90%
Only Bob's computer
has been configured.

100
03:51.693 --> 03:53.110 align:middle line:90%
And that's how
port security, when

101
03:53.110 --> 03:55.030 align:middle line:90%
it's applied to layer
two switch ports

102
03:55.030 --> 03:56.280 align:middle line:84%
can help protect our network.

103
03:56.280 --> 03:59.170 align:middle line:90%
And in the very next video, you
and I will walk through a lab

104
03:59.170 --> 04:02.440 align:middle line:90%
where we'll implement and verify
port security on a layer two
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

104
03:59.170 --> 04:02.440 align:middle line:90%
where we'll implement and verify
port security on a layer two

105
04:02.440 --> 04:03.020 align:middle line:84%
interface.

106
04:03.020 --> 04:04.700 align:middle line:90%
So I'll see you there
in just a moment.

107
04:04.700 --> 04:07.120 align:middle line:90%
Meanwhile, I hope this has
been informative for you.

108
04:07.120 --> 04:09.990 align:middle line:90%
And I'd like to thank
you for viewing.