WEBVTT

1
00:00.000 --> 00:00.500 align:middle line:84%


2
00:00.500 --> 00:02.490 align:middle line:90%
In this video, you and
I get to both implement

3
00:02.490 --> 00:05.880 align:middle line:90%
and verify port security
on a Layer-2 switch port.

4
00:05.880 --> 00:07.120 align:middle line:84%
Let's begin.

5
00:07.120 --> 00:08.940 align:middle line:90%
So for our plan of
attack, let's do this.

6
00:08.940 --> 00:11.880 align:middle line:90%
Let's work with the access
layer switch with its gig 00

7
00:11.880 --> 00:15.540 align:middle line:90%
interface that it happens to
be where there's a computer.

8
00:15.540 --> 00:16.990 align:middle line:84%
It's actually Kali Linux box.

9
00:16.990 --> 00:18.750 align:middle line:90%
It's available to
you in the lab.

10
00:18.750 --> 00:20.850 align:middle line:90%
And let's go to
interface gig 00.

11
00:20.850 --> 00:23.910 align:middle line:90%
We'll do switch port mode access
because we cannot use a dynamic

12
00:23.910 --> 00:24.810 align:middle line:84%
port.

13
00:24.810 --> 00:26.210 align:middle line:90%
Let's just say
switch port access

14
00:26.210 --> 00:28.410 align:middle line:90%
VLAN 10 to make sure
that's in the right VLAN

15
00:28.410 --> 00:29.730 align:middle line:84%
and switch port host.

16
00:29.730 --> 00:32.200 align:middle line:90%
In our lab environment, I
need to do that one as well.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

16
00:29.730 --> 00:32.200 align:middle line:90%
In our lab environment, I
need to do that one as well.

17
00:32.200 --> 00:34.860 align:middle line:90%
So it'll actually forced
the switch port mode access.

18
00:34.860 --> 00:36.470 align:middle line:90%
It will also do
the Portfast, which

19
00:36.470 --> 00:39.580 align:middle line:90%
be much better as far as
balancing the port up and down.

20
00:39.580 --> 00:43.620 align:middle line:90%
So let's do all these
three for this port.

21
00:43.620 --> 00:45.320 align:middle line:90%
And then we can do
a show VLAN brief.

22
00:45.320 --> 00:47.370 align:middle line:90%
And the do command is because
we're in configuration mode.

23
00:47.370 --> 00:48.270 align:middle line:84%
We need the do commands.

24
00:48.270 --> 00:49.470 align:middle line:84%
We can do our show commands.

25
00:49.470 --> 00:52.800 align:middle line:90%
So we'll do a show VLAN brief
just to verify that gig 00 is

26
00:52.800 --> 00:54.290 align:middle line:84%
associated with VLAN 10.

27
00:54.290 --> 00:57.240 align:middle line:90%
We'll also do a show Mac
address table for VLAN 10

28
00:57.240 --> 00:58.608 align:middle line:84%
to see how many are there.

29
00:58.608 --> 01:00.900 align:middle line:90%
And we have other commands
like show port dash security
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

29
00:58.608 --> 01:00.900 align:middle line:90%
And we have other commands
like show port dash security

30
01:00.900 --> 01:04.092 align:middle line:90%
for a specific interface, and
show port security in general.

31
01:04.092 --> 01:05.550 align:middle line:90%
And then this
command right here is

32
01:05.550 --> 01:07.090 align:middle line:84%
what's going to implement it.

33
01:07.090 --> 01:10.440 align:middle line:90%
And I put all these up here
because we may or may not

34
01:10.440 --> 01:11.670 align:middle line:84%
do them in the exact order.

35
01:11.670 --> 01:13.170 align:middle line:90%
But these are the
commands that will

36
01:13.170 --> 01:16.110 align:middle line:90%
be very helpful as
you and I discover,

37
01:16.110 --> 01:19.350 align:middle line:90%
verify, and then
correct, if we need to,

38
01:19.350 --> 01:22.880 align:middle line:90%
any challenges that arise as
a result of port security.

39
01:22.880 --> 01:25.240 align:middle line:90%
And you'll see what I
mean in just a moment.

40
01:25.240 --> 01:28.350 align:middle line:90%
So let's go to the lab and let's
go to the axis layer switch

41
01:28.350 --> 01:31.230 align:middle line:90%
and start working
on interface gig 00.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

41
01:28.350 --> 01:31.230 align:middle line:90%
and start working
on interface gig 00.

42
01:31.230 --> 01:33.420 align:middle line:90%
So here in DC NUG, which
is our management computer,

43
01:33.420 --> 01:35.640 align:middle line:90%
we'll open up PUTTY in
the upper left hand corner

44
01:35.640 --> 01:37.950 align:middle line:90%
and we'll open up a
connection to access 1, which

45
01:37.950 --> 01:40.070 align:middle line:84%
is our access layer switch.

46
01:40.070 --> 01:44.550 align:middle line:90%
And let's go to
interface gig 0/0.

47
01:44.550 --> 01:47.670 align:middle line:90%
And we'll do a switch
port mode access,

48
01:47.670 --> 01:51.810 align:middle line:84%
and switch port access VLAN 10.

49
01:51.810 --> 01:54.960 align:middle line:90%
And we'll also do a switch
port host, which will also

50
01:54.960 --> 01:58.030 align:middle line:84%
enable Portfast on that port.

51
01:58.030 --> 02:01.195 align:middle line:90%
So the switchboard host is
very convenient for the reasons
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

51
01:58.030 --> 02:01.195 align:middle line:90%
So the switchboard host is
very convenient for the reasons

52
02:01.195 --> 02:02.070 align:middle line:84%
we just talked about.

53
02:02.070 --> 02:03.880 align:middle line:90%
But also in this
lab environment,

54
02:03.880 --> 02:05.382 align:middle line:90%
it's important to
make the lab work.

55
02:05.382 --> 02:07.590 align:middle line:90%
So please include that when
you do the lab, if you're

56
02:07.590 --> 02:09.232 align:middle line:84%
doing it on the virtual lab.

57
02:09.232 --> 02:10.440 align:middle line:84%
So let's verify a few things.

58
02:10.440 --> 02:13.440 align:middle line:84%
We'll do a show VLAN brief.

59
02:13.440 --> 02:17.580 align:middle line:90%
And sure enough, there's
gig 00 assigned to VLAN 10.

60
02:17.580 --> 02:18.660 align:middle line:84%
That's great.

61
02:18.660 --> 02:22.140 align:middle line:90%
Let's also do a
show Mac address.

62
02:22.140 --> 02:24.970 align:middle line:90%
Now, because we're in
interface configuration mode,

63
02:24.970 --> 02:26.973 align:middle line:90%
it's not going to be
really helpful very often

64
02:26.973 --> 02:28.140 align:middle line:84%
when context sensitive help.

65
02:28.140 --> 02:29.992 align:middle line:90%
So by knowing the
command, you'd have

66
02:29.992 --> 02:31.200 align:middle line:84%
to actually type it out here.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

66
02:29.992 --> 02:31.200 align:middle line:84%
to actually type it out here.

67
02:31.200 --> 02:33.360 align:middle line:84%
So do show Mac address.

68
02:33.360 --> 02:35.820 align:middle line:84%
Dash table for VLAN 10.

69
02:35.820 --> 02:37.150 align:middle line:84%
Press Enter.

70
02:37.150 --> 02:39.150 align:middle line:90%
And the key is if you
don't remember the syntax,

71
02:39.150 --> 02:40.817 align:middle line:90%
you could drop out
of configuration mode

72
02:40.817 --> 02:42.360 align:middle line:90%
back to privilege
mode, and then just

73
02:42.360 --> 02:44.940 align:middle line:90%
do the question marks to
get the context sensitive

74
02:44.940 --> 02:45.872 align:middle line:84%
help along the way.

75
02:45.872 --> 02:48.330 align:middle line:90%
So here, I just want to verify
how many Mac addresses were.

76
02:48.330 --> 02:50.882 align:middle line:90%
Currently, they're in by the
switch associated with VLAN 10.

77
02:50.882 --> 02:52.590 align:middle line:90%
If we hit the up arrow
key, we could also

78
02:52.590 --> 02:56.760 align:middle line:90%
add the interface gig
0/0 as a condition.

79
02:56.760 --> 02:59.310 align:middle line:90%
And that would show us just the
Mac addresses associated with

80
02:59.310 --> 03:01.470 align:middle line:84%
VLAN just on gig 00.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

80
02:59.310 --> 03:01.470 align:middle line:84%
VLAN just on gig 00.

81
03:01.470 --> 03:02.340 align:middle line:84%
We have 3.

82
03:02.340 --> 03:05.190 align:middle line:90%
And there is our Kali Linux
box from our previous video,

83
03:05.190 --> 03:06.460 align:middle line:84%
so that's great.

84
03:06.460 --> 03:12.070 align:middle line:90%
Now, currently if we do a show
port security for interface gig

85
03:12.070 --> 03:15.330 align:middle line:90%
0/0, it's going to
say it's disabled.

86
03:15.330 --> 03:17.760 align:middle line:90%
You don't have port security
enabled on this interface.

87
03:17.760 --> 03:19.920 align:middle line:90%
But it is showing us
that if we did enable it,

88
03:19.920 --> 03:22.170 align:middle line:90%
that the violation
mode, if we exceeded

89
03:22.170 --> 03:25.410 align:middle line:90%
the maximum of Mac addresses,
it would be shut down.

90
03:25.410 --> 03:27.880 align:middle line:90%
And also, here's the maximum
number of Mac addresses.

91
03:27.880 --> 03:29.910 align:middle line:90%
However, because it's
disabled, that feature

92
03:29.910 --> 03:31.653 align:middle line:84%
is not being used at the moment.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

92
03:29.910 --> 03:31.653 align:middle line:84%
is not being used at the moment.

93
03:31.653 --> 03:34.320 align:middle line:90%
So I want to point out something
before we enable port security.

94
03:34.320 --> 03:37.110 align:middle line:90%
So the maximum number
of learned Mac addresses

95
03:37.110 --> 03:40.170 align:middle line:90%
on the port, if we
enable the feature as one

96
03:40.170 --> 03:42.410 align:middle line:90%
and if we go above one,
we're going to go ahead

97
03:42.410 --> 03:44.702 align:middle line:90%
have a violation, which is
going to shut down the port.

98
03:44.702 --> 03:45.990 align:middle line:84%
Look at this.

99
03:45.990 --> 03:50.680 align:middle line:90%
For VLAN 10, all off of gig
00 in the lab environment,

100
03:50.680 --> 03:52.630 align:middle line:90%
I see three different
Mac addresses.

101
03:52.630 --> 03:55.860 align:middle line:90%
And that's, if I do the math
on that, that's like too many.

102
03:55.860 --> 03:58.830 align:middle line:90%
So just be aware that if
we enable port security,

103
03:58.830 --> 04:02.340 align:middle line:90%
which we're going to do, if we
need port security and we have
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

103
03:58.830 --> 04:02.340 align:middle line:90%
which we're going to do, if we
need port security and we have

104
04:02.340 --> 04:05.490 align:middle line:90%
more than just one device
that sends a frame,

105
04:05.490 --> 04:08.040 align:middle line:90%
we're going to have a violation
and a port can be shut down

106
04:08.040 --> 04:10.623 align:middle line:90%
because we currently have three
Mac addresses that are hanging

107
04:10.623 --> 04:13.200 align:middle line:90%
off of that gig 00 that
could speak at anytime.

108
04:13.200 --> 04:16.018 align:middle line:90%
One of the command is a
show port dash security.

109
04:16.018 --> 04:18.310 align:middle line:90%
And that's just going to show
us all of our interfaces.

110
04:18.310 --> 04:20.065 align:middle line:90%
So we have no interfaces
that currently

111
04:20.065 --> 04:21.190 align:middle line:84%
have port security enabled.

112
04:21.190 --> 04:23.740 align:middle line:90%
And as a result, they're
not showing up here.

113
04:23.740 --> 04:26.025 align:middle line:90%
So let's enable port
security with the knowledge

114
04:26.025 --> 04:27.900 align:middle line:90%
that we're probably
going to get a violation.

115
04:27.900 --> 04:30.330 align:middle line:90%
So we'll go ahead and we're
still in interface config
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

115
04:27.900 --> 04:30.330 align:middle line:90%
So we'll go ahead and we're
still in interface config

116
04:30.330 --> 04:31.490 align:middle line:84%
for gig 00.

117
04:31.490 --> 04:35.520 align:middle line:90%
And the syntax is switch
port space port security.

118
04:35.520 --> 04:36.390 align:middle line:84%
That's it.

119
04:36.390 --> 04:38.040 align:middle line:84%
And that'll take the defaults.

120
04:38.040 --> 04:40.170 align:middle line:84%
And it is now active.

121
04:40.170 --> 04:43.920 align:middle line:90%
So if we do a show port
security, press Enter,

122
04:43.920 --> 04:47.730 align:middle line:90%
it now shows us that gig 00
is port security enabled.

123
04:47.730 --> 04:50.940 align:middle line:90%
The security action, that's the
violation action, is shut down.

124
04:50.940 --> 04:54.120 align:middle line:90%
And the maximum Mac addresses
that is willing to handle

125
04:54.120 --> 04:55.638 align:middle line:84%
is one on that port.

126
04:55.638 --> 04:58.180 align:middle line:90%
So the moment we have more than
one Mac address who generates

127
04:58.180 --> 05:01.610 align:middle line:90%
a frame on gig 00,
that the switch sees,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

127
04:58.180 --> 05:01.610 align:middle line:90%
a frame on gig 00,
that the switch sees,

128
05:01.610 --> 05:04.320 align:middle line:90%
we're going to have a
port security violation.

129
05:04.320 --> 05:06.570 align:middle line:90%
And if we don't want to wait
for it, we don't have to.

130
05:06.570 --> 05:08.740 align:middle line:84%
So we go to our Kali Linux box.

131
05:08.740 --> 05:12.570 align:middle line:90%
And for the Kali Linux box,
the user is root, R-O-O-T.

132
05:12.570 --> 05:16.460 align:middle line:90%
And the password is root
backwards, which is T-O-O-R,

133
05:16.460 --> 05:17.700 align:middle line:84%
and press Enter.

134
05:17.700 --> 05:19.440 align:middle line:90%
And here on Kali Linux
over on the left,

135
05:19.440 --> 05:21.600 align:middle line:90%
if we click on the icon
to open a terminal,

136
05:21.600 --> 05:23.110 align:middle line:84%
it'll do that for us.

137
05:23.110 --> 05:26.550 align:middle line:90%
And from here, let's
do a ping to 10.16.0.1,

138
05:26.550 --> 05:29.970 align:middle line:90%
which is just the switch
virtual interface on Core One.

139
05:29.970 --> 05:30.600 align:middle line:84%
Yeah.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

139
05:29.970 --> 05:30.600 align:middle line:84%
Yeah.

140
05:30.600 --> 05:32.760 align:middle line:84%
Check it out.

141
05:32.760 --> 05:34.530 align:middle line:90%
The reason that's not
working is because I

142
05:34.530 --> 05:36.822 align:middle line:90%
guess the other Mac address
from one other device

143
05:36.822 --> 05:37.530 align:middle line:84%
was already seen.

144
05:37.530 --> 05:41.220 align:middle line:90%
And now because Kali's trying
to talk, he's being rejected

145
05:41.220 --> 05:42.940 align:middle line:90%
and that port has
been shut down.

146
05:42.940 --> 05:45.160 align:middle line:90%
We can verify that by
going back to the CLI.

147
05:45.160 --> 05:45.660 align:middle line:84%
All right.

148
05:45.660 --> 05:48.150 align:middle line:90%
So here, we have the
port security violation

149
05:48.150 --> 05:49.120 align:middle line:84%
caused by Mac address.

150
05:49.120 --> 05:49.620 align:middle line:84%
It was.

151
05:49.620 --> 05:53.130 align:middle line:90%
The Mac address of the one from
our Kali Linux box on gig 00.

152
05:53.130 --> 05:55.990 align:middle line:84%
And that interface is down.

153
05:55.990 --> 05:58.200 align:middle line:90%
Nobody is happy about
that, as far as anybody

154
05:58.200 --> 05:59.490 align:middle line:84%
who is on that port before.

155
05:59.490 --> 06:03.060 align:middle line:90%
If we do a show
interface status,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

155
05:59.490 --> 06:03.060 align:middle line:90%
If we do a show
interface status,

156
06:03.060 --> 06:04.890 align:middle line:84%
space ERR dash disabled.

157
06:04.890 --> 06:05.787 align:middle line:84%
Press Enter.

158
06:05.787 --> 06:08.370 align:middle line:90%
That will show all of our ports
that are err disabled and also

159
06:08.370 --> 06:09.110 align:middle line:84%
the reason.

160
06:09.110 --> 06:10.740 align:middle line:90%
So we have a port
security violation,

161
06:10.740 --> 06:12.125 align:middle line:84%
which caused it to go down.

162
06:12.125 --> 06:14.250 align:middle line:90%
So in this video and lab,
we've had the opportunity

163
06:14.250 --> 06:16.200 align:middle line:90%
to implement port
security, and also

164
06:16.200 --> 06:18.120 align:middle line:90%
get a first hand
seat looking at wow,

165
06:18.120 --> 06:20.700 align:middle line:90%
there goes the violation because
we had more than the default

166
06:20.700 --> 06:23.760 align:middle line:90%
of one Mac address that
showed up as a source address

167
06:23.760 --> 06:24.850 align:middle line:84%
on that port.

168
06:24.850 --> 06:27.120 align:middle line:90%
So in the next video, what
I can do is talk with you

169
06:27.120 --> 06:29.040 align:middle line:90%
about some common
tweaks that we're

170
06:29.040 --> 06:31.840 align:middle line:90%
likely to do in a production
environment with port security
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

170
06:29.040 --> 06:31.840 align:middle line:90%
likely to do in a production
environment with port security

171
06:31.840 --> 06:33.610 align:middle line:90%
so it helps us in
protecting the network.

172
06:33.610 --> 06:36.330 align:middle line:90%
And at the same time, not
causing a lot of overhead

173
06:36.330 --> 06:38.310 align:middle line:90%
imports going down
unnecessarily.

174
06:38.310 --> 06:39.810 align:middle line:84%
So I'll see you in the next lab.

175
06:39.810 --> 06:42.270 align:middle line:90%
Meanwhile, I hope this has
been informative for you

176
06:42.270 --> 06:45.410 align:middle line:90%
and I'd like to thank
you for viewing.