WEBVTT

1
00:00.000 --> 00:00.830 align:middle line:84%


2
00:00.830 --> 00:03.200 align:middle line:90%
In the previous video and
lab, we enabled port security,

3
00:03.200 --> 00:05.930 align:middle line:90%
and boom right away got
a port security violation

4
00:05.930 --> 00:08.150 align:middle line:90%
because the default
for the maximum number

5
00:08.150 --> 00:11.180 align:middle line:90%
of Mac addresses on that port
to be learned is just one.

6
00:11.180 --> 00:13.520 align:middle line:90%
So in this video and
lab, we'll take a look

7
00:13.520 --> 00:16.290 align:middle line:90%
at some customization and
tweaking for port security

8
00:16.290 --> 00:18.950 align:middle line:90%
that can make him more
agreeable and survivable

9
00:18.950 --> 00:20.715 align:middle line:84%
in a production environment.

10
00:20.715 --> 00:23.090 align:middle line:90%
So I have reset the lab, and
here's what I propose we do.

11
00:23.090 --> 00:25.040 align:middle line:90%
Let's go through
the steps of making

12
00:25.040 --> 00:26.530 align:middle line:84%
sure we're not a dynamic port.

13
00:26.530 --> 00:29.660 align:middle line:90%
So these two to make sure
it's an access port not

14
00:29.660 --> 00:32.390 align:middle line:90%
dynamically negotiated,
also the switch port host
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

14
00:29.660 --> 00:32.390 align:middle line:90%
dynamically negotiated,
also the switch port host

15
00:32.390 --> 00:34.970 align:middle line:90%
for the benefit of
spanning tree and Portfast.

16
00:34.970 --> 00:37.230 align:middle line:90%
And also for the lab for
this to work correctly,

17
00:37.230 --> 00:38.567 align:middle line:84%
please use that as well.

18
00:38.567 --> 00:40.150 align:middle line:90%
So we did those in
the previous video.

19
00:40.150 --> 00:41.525 align:middle line:90%
Now for the new
commands, we have

20
00:41.525 --> 00:43.300 align:middle line:90%
a switchport, port
security, maximum.

21
00:43.300 --> 00:46.670 align:middle line:90%
So instead of saying hey maximum
number of source Mac addresses

22
00:46.670 --> 00:50.090 align:middle line:90%
on this gig 0/0 port,
let's go ahead and set it

23
00:50.090 --> 00:52.460 align:middle line:90%
to a number that's something
a little more reasonable.

24
00:52.460 --> 00:55.580 align:middle line:90%
Because you might have
devices, or virtual devices,

25
00:55.580 --> 00:58.820 align:middle line:90%
that have two or three Mac
addresses on that port.

26
00:58.820 --> 01:01.010 align:middle line:90%
And so I think five, or
whatever your company
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

26
00:58.820 --> 01:01.010 align:middle line:90%
And so I think five, or
whatever your company

27
01:01.010 --> 01:02.720 align:middle line:90%
thinks is a
reasonable number, is

28
01:02.720 --> 01:06.310 align:middle line:90%
going to help in not
having violations or alerts

29
01:06.310 --> 01:08.120 align:middle line:84%
when there's not a real problem.

30
01:08.120 --> 01:11.270 align:middle line:90%
We can also-- if we know that
Bob's computer off gig 0/0

31
01:11.270 --> 01:12.770 align:middle line:90%
is a specific Mac
address, we can

32
01:12.770 --> 01:15.920 align:middle line:90%
code it with switchboard
port security Mac address

33
01:15.920 --> 01:19.292 align:middle line:90%
and put in that layer 212
hexidecimal character address.

34
01:19.292 --> 01:20.750 align:middle line:90%
And that will
guarantee that Bob is

35
01:20.750 --> 01:23.240 align:middle line:90%
going to be one of those five
that's going to be allowed.

36
01:23.240 --> 01:25.850 align:middle line:90%
Another option is we can
plug-in Bob's computer

37
01:25.850 --> 01:28.650 align:middle line:90%
and use this command, switchport
port security, Mac address,

38
01:28.650 --> 01:29.460 align:middle line:84%
sticky.

39
01:29.460 --> 01:31.670 align:middle line:90%
And what that does, it
takes the Mac addresses
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

39
01:29.460 --> 01:31.670 align:middle line:90%
And what that does, it
takes the Mac addresses

40
01:31.670 --> 01:34.100 align:middle line:90%
that are learned on
that port dynamically,

41
01:34.100 --> 01:36.090 align:middle line:90%
and it puts it in
the running config.

42
01:36.090 --> 01:38.900 align:middle line:90%
So once those Mac addresses have
been learned, we can do a copy,

43
01:38.900 --> 01:39.650 align:middle line:84%
run, start.

44
01:39.650 --> 01:41.880 align:middle line:90%
And then they'll be the
startup config as well.

45
01:41.880 --> 01:43.730 align:middle line:90%
So the sticky option
is a creative way

46
01:43.730 --> 01:45.362 align:middle line:90%
of dynamically
learning an address

47
01:45.362 --> 01:47.570 align:middle line:90%
and getting it into the
running config without having

48
01:47.570 --> 01:48.883 align:middle line:84%
to manually configure it.

49
01:48.883 --> 01:50.800 align:middle line:90%
And then based on your
policy at your company,

50
01:50.800 --> 01:53.217 align:middle line:90%
you can decide what you want
the violation response to be.

51
01:53.217 --> 01:55.670 align:middle line:90%
In this case, if we go
above five Mac addresses--

52
01:55.670 --> 01:57.410 align:middle line:84%
a sixth Mac address shows up--

53
01:57.410 --> 01:59.560 align:middle line:90%
the default violation is
to shut down the port.

54
01:59.560 --> 02:01.310 align:middle line:90%
But we may not want
to shut down the port.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

54
01:59.560 --> 02:01.310 align:middle line:90%
But we may not want
to shut down the port.

55
02:01.310 --> 02:04.400 align:middle line:90%
Maybe we just want to
restrict any Mac addresses

56
02:04.400 --> 02:07.920 align:middle line:90%
above those five from being
able to forward traffic.

57
02:07.920 --> 02:11.210 align:middle line:90%
So both the restrict and
protect options do that.

58
02:11.210 --> 02:12.920 align:middle line:90%
And the restrict,
if used instead

59
02:12.920 --> 02:15.890 align:middle line:90%
of to protect and restrict,
also add some additional logging

60
02:15.890 --> 02:17.040 align:middle line:84%
capabilities.

61
02:17.040 --> 02:19.760 align:middle line:90%
It also increments the
port security hit counter

62
02:19.760 --> 02:21.858 align:middle line:84%
for violations when it occurs.

63
02:21.858 --> 02:23.150 align:middle line:84%
So here's what I propose we do.

64
02:23.150 --> 02:25.580 align:middle line:90%
Let's implement this
back on gig 0/0.

65
02:25.580 --> 02:29.000 align:middle line:90%
And for shut down, let's leave
the default violation action

66
02:29.000 --> 02:29.990 align:middle line:84%
as shutdown.

67
02:29.990 --> 02:32.150 align:middle line:90%
Because if we set it
to five and we only
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

67
02:29.990 --> 02:32.150 align:middle line:90%
Because if we set it
to five and we only

68
02:32.150 --> 02:35.020 align:middle line:90%
have three Mac addresses
coming in off that port,

69
02:35.020 --> 02:36.830 align:middle line:90%
it won't hit the
violation unless there's

70
02:36.830 --> 02:38.928 align:middle line:84%
some funny business going on.

71
02:38.928 --> 02:40.970 align:middle line:90%
And in that case, we would
want the port possibly

72
02:40.970 --> 02:43.460 align:middle line:90%
to shut down, so that we can
stop and investigate and find

73
02:43.460 --> 02:44.772 align:middle line:84%
out what's going on.

74
02:44.772 --> 02:46.730 align:middle line:90%
So in the hands on lab,
it's good for our admin

75
02:46.730 --> 02:48.370 align:middle line:84%
PC which is DCNUG.

76
02:48.370 --> 02:50.660 align:middle line:90%
We'll open up PuTTy We'll
go to the access layer

77
02:50.660 --> 02:52.220 align:middle line:84%
switch on gig 0/0.

78
02:52.220 --> 02:54.570 align:middle line:90%
And let's implement
these commands.

79
02:54.570 --> 02:57.380 align:middle line:90%
So here on DCNUG, we'll
open up empty PuTTy.

80
02:57.380 --> 02:59.240 align:middle line:90%
And then next, we'll
grab the Servers tab

81
02:59.240 --> 03:01.610 align:middle line:84%
and open up Access 1.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

81
02:59.240 --> 03:01.610 align:middle line:84%
and open up Access 1.

82
03:01.610 --> 03:05.300 align:middle line:90%
So we'll go to Configuration
mode, interface gig 0/0.

83
03:05.300 --> 03:08.750 align:middle line:90%
And we'll switch
port access vlan 10.

84
03:08.750 --> 03:11.780 align:middle line:90%
And switch port
mode access, great.

85
03:11.780 --> 03:13.880 align:middle line:90%
And then also switch
port hosts, which

86
03:13.880 --> 03:16.250 align:middle line:90%
will do these switch
port mode access for us

87
03:16.250 --> 03:17.900 align:middle line:90%
but also enables
Portfast as well.

88
03:17.900 --> 03:20.740 align:middle line:90%
And in the lab, it's
required to make it work.

89
03:20.740 --> 03:21.240 align:middle line:84%
All right.

90
03:21.240 --> 03:23.180 align:middle line:90%
So looking at it, notice
that's the first three steps.

91
03:23.180 --> 03:25.472 align:middle line:90%
Next, let's change the maximum
number of Mac addresses.

92
03:25.472 --> 03:28.580 align:middle line:90%
Instead of being one,
we'll change it to five.

93
03:28.580 --> 03:32.840 align:middle line:90%
So switchport, port
security, maximum of five.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

93
03:28.580 --> 03:32.840 align:middle line:90%
So switchport, port
security, maximum of five.

94
03:32.840 --> 03:33.650 align:middle line:84%
Press Enter.

95
03:33.650 --> 03:36.020 align:middle line:90%
I also want you to note
that we have not yet

96
03:36.020 --> 03:38.630 align:middle line:90%
enabled the feature of port
security on this interface.

97
03:38.630 --> 03:41.210 align:middle line:90%
We're making all these changes
regarding port security,

98
03:41.210 --> 03:43.820 align:middle line:90%
but it's not actually enabled
until we use the command

99
03:43.820 --> 03:47.180 align:middle line:90%
switchport, port-security all
by itself and press Enter.

100
03:47.180 --> 03:48.710 align:middle line:90%
And that's the
moment port security

101
03:48.710 --> 03:51.020 align:middle line:90%
is going to be enabled
on this interface.

102
03:51.020 --> 03:53.840 align:middle line:90%
Next, let's manually
configure a Mac address

103
03:53.840 --> 03:57.030 align:middle line:90%
that we want port security
to be aware of on this port.

104
03:57.030 --> 04:02.030 align:middle line:90%
So the syntax is switchport,
port security, Mac address,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

104
03:57.030 --> 04:02.030 align:middle line:90%
So the syntax is switchport,
port security, Mac address,

105
04:02.030 --> 04:03.380 align:middle line:84%
and then the syntax.

106
04:03.380 --> 04:05.545 align:middle line:90%
If use a question mark,
it'll tell us the syntax.

107
04:05.545 --> 04:06.920 align:middle line:90%
And now it's giving
us the format

108
04:06.920 --> 04:09.510 align:middle line:90%
it wants us to put in,
the 48-bit Mac address.

109
04:09.510 --> 04:14.300 align:middle line:90%
So we're going to use
one 1122, a period, 3344,

110
04:14.300 --> 04:17.870 align:middle line:90%
a period, and a 5566, because
that's the format they're

111
04:17.870 --> 04:20.060 align:middle line:84%
asking for, and press Enter.

112
04:20.060 --> 04:23.480 align:middle line:90%
Oh ho, ho, ho, ho,
ho, ho, ho, ho.

113
04:23.480 --> 04:26.290 align:middle line:90%
It doesn't like that because
of the first bits of that Mac

114
04:26.290 --> 04:26.790 align:middle line:84%
address.

115
04:26.790 --> 04:27.770 align:middle line:84%
Let's take a look at my notes.

116
04:27.770 --> 04:28.460 align:middle line:84%
Oh, yeah, yeah.

117
04:28.460 --> 04:30.500 align:middle line:84%
OK so we'll use 0/0.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

117
04:28.460 --> 04:30.500 align:middle line:84%
OK so we'll use 0/0.

118
04:30.500 --> 04:33.110 align:middle line:90%
So there are some rules in the
first several bits of the Mac

119
04:33.110 --> 04:35.070 align:middle line:84%
address, and I broke this rule.

120
04:35.070 --> 04:36.290 align:middle line:84%
So I hit the upper key.

121
04:36.290 --> 04:41.146 align:middle line:90%
And we'll change the
first two numbers to 0/0.

122
04:41.146 --> 04:42.708 align:middle line:90%
That should make
it happy, happy.

123
04:42.708 --> 04:43.250 align:middle line:84%
There you go.

124
04:43.250 --> 04:44.460 align:middle line:84%
All right.

125
04:44.460 --> 04:46.460 align:middle line:90%
Next, let's go ahead and
add the sticky command.

126
04:46.460 --> 04:48.530 align:middle line:90%
So dynamically, we learned
Mac addresses will be

127
04:48.530 --> 04:50.730 align:middle line:84%
placed in the running config.

128
04:50.730 --> 04:55.250 align:middle line:90%
So they've been switch port,
port security, Mac address,

129
04:55.250 --> 04:57.715 align:middle line:90%
and the keyword sticky,
and press Enter.

130
04:57.715 --> 04:59.840 align:middle line:90%
And for the violation,
let's leave the violation as

131
04:59.840 --> 05:02.910 align:middle line:90%
shut down, to shut down the
port if we go over five.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

131
04:59.840 --> 05:02.910 align:middle line:90%
shut down, to shut down the
port if we go over five.

132
05:02.910 --> 05:05.880 align:middle line:90%
Now as I mentioned, the very
important aspect we need to do

133
05:05.880 --> 05:06.810 align:middle line:84%
is to enable this.

134
05:06.810 --> 05:10.135 align:middle line:90%
So if we did a do show
port security right now,

135
05:10.135 --> 05:11.760 align:middle line:90%
you'll notice that
port security is not

136
05:11.760 --> 05:14.670 align:middle line:90%
enabled on any interfaces
including this gig 0/0,

137
05:14.670 --> 05:17.850 align:middle line:90%
because we have to use
this command, switchport,

138
05:17.850 --> 05:20.010 align:middle line:84%
port security, and press Enter.

139
05:20.010 --> 05:20.730 align:middle line:84%
Boom.

140
05:20.730 --> 05:21.690 align:middle line:84%
And that enables it.

141
05:21.690 --> 05:23.773 align:middle line:90%
So if we use the upper
arrow key a couple of times

142
05:23.773 --> 05:26.640 align:middle line:90%
and do a show port security,
now we can see that gig 0/0,

143
05:26.640 --> 05:27.540 align:middle line:84%
has it enabled.

144
05:27.540 --> 05:29.220 align:middle line:90%
The maximum Mac
addresses is five.

145
05:29.220 --> 05:32.070 align:middle line:90%
Currently, it knows about
one, and the security action
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

145
05:29.220 --> 05:32.070 align:middle line:90%
Currently, it knows about
one, and the security action

146
05:32.070 --> 05:33.100 align:middle line:84%
is shut down.

147
05:33.100 --> 05:35.757 align:middle line:90%
We can also do a do
show port security.

148
05:35.757 --> 05:38.340 align:middle line:90%
And it's not helping me because
I'm in interface configuration

149
05:38.340 --> 05:38.580 align:middle line:84%
mode.

150
05:38.580 --> 05:40.390 align:middle line:90%
So in context sense,
it'll help us out.

151
05:40.390 --> 05:43.765 align:middle line:90%
But do show port security
for interface gig 0/0

152
05:43.765 --> 05:44.390 align:middle line:84%
is the command.

153
05:44.390 --> 05:45.890 align:middle line:84%
We'll press Enter.

154
05:45.890 --> 05:48.210 align:middle line:90%
And that's showing us
the details for gig 0/0.

155
05:48.210 --> 05:52.605 align:middle line:90%
So it's enabled, the violation
is shut down if it happens.

156
05:52.605 --> 05:53.730 align:middle line:84%
And currently look at that.

157
05:53.730 --> 05:54.660 align:middle line:84%
We're up to two Mac address.

158
05:54.660 --> 05:55.160 align:middle line:84%
Great.

159
05:55.160 --> 05:56.678 align:middle line:84%
Up to a maximum of five.

160
05:56.678 --> 05:59.220 align:middle line:90%
It also shows that we have one
configured Mac address and one

161
05:59.220 --> 06:00.180 align:middle line:84%
sticky Mac address.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

161
05:59.220 --> 06:00.180 align:middle line:84%
sticky Mac address.

162
06:00.180 --> 06:01.680 align:middle line:84%
Fantastic.

163
06:01.680 --> 06:03.480 align:middle line:90%
So let's exit out of
configuration mode.

164
06:03.480 --> 06:09.360 align:middle line:90%
And let's do a show Mac address
table for interface gig 0/0.

165
06:09.360 --> 06:09.860 align:middle line:84%
All right.

166
06:09.860 --> 06:11.910 align:middle line:90%
So we've got three
Mac addresses.

167
06:11.910 --> 06:14.380 align:middle line:90%
And now that we're willing to
support five Mac addresses,

168
06:14.380 --> 06:18.050 align:middle line:90%
let's go generate a failure by
going to our Kali Linux box.

169
06:18.050 --> 06:20.340 align:middle line:90%
And on the Kali Linux
box, we'll log in as root.

170
06:20.340 --> 06:24.240 align:middle line:90%
The password is T-O-O-R,
which is root backwards.

171
06:24.240 --> 06:26.020 align:middle line:84%
And we'll open up a terminal.

172
06:26.020 --> 06:28.660 align:middle line:90%
So we'll open up a terminal
by clicking the icon for that

173
06:28.660 --> 06:30.620 align:middle line:84%
over here on the left.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

173
06:28.660 --> 06:30.620 align:middle line:84%
over here on the left.

174
06:30.620 --> 06:34.500 align:middle line:90%
In here, let's do a
ping to 10.16.0.1 just

175
06:34.500 --> 06:35.458 align:middle line:84%
to verify connectivity.

176
06:35.458 --> 06:36.000 align:middle line:84%
That's great.

177
06:36.000 --> 06:36.740 align:middle line:84%
No problem there.

178
06:36.740 --> 06:40.050 align:middle line:90%
That's the vlan 10 layer
3 interface of core one

179
06:40.050 --> 06:41.050 align:middle line:84%
that we just pinged.

180
06:41.050 --> 06:43.958 align:middle line:90%
And we're going to ping core
2's vlan 10 layer 3 interface.

181
06:43.958 --> 06:45.750 align:middle line:90%
We could put its IP
address in and ping it.

182
06:45.750 --> 06:46.600 align:middle line:84%
That's great.

183
06:46.600 --> 06:48.660 align:middle line:90%
And I'll do a Control
C to stop that as well.

184
06:48.660 --> 06:52.170 align:middle line:90%
And if you go back to DCNUG,
to our admin PC, and to the CLI

185
06:52.170 --> 06:54.797 align:middle line:90%
the access layer switch,
hit the upper arrow key,

186
06:54.797 --> 06:57.130 align:middle line:90%
you'll notice we now have
some additional Mac addresses,

187
06:57.130 --> 06:59.880 align:middle line:90%
including we have the Mac
address for our Kali Linux Box

188
06:59.880 --> 07:00.750 align:middle line:84%
right there.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

188
06:59.880 --> 07:00.750 align:middle line:84%
right there.

189
07:00.750 --> 07:03.390 align:middle line:90%
So we're still under the
window for port security, which

190
07:03.390 --> 07:05.120 align:middle line:90%
is a maximum of
five for that port.

191
07:05.120 --> 07:06.870 align:middle line:90%
So let's go back to
the Kali Linux box.

192
07:06.870 --> 07:09.000 align:middle line:90%
And at that the command
line, let's do a macof.

193
07:09.000 --> 07:11.250 align:middle line:90%
We go a cam table
overflow attack.

194
07:11.250 --> 07:13.590 align:middle line:90%
And we'll do a dash
I for interface.

195
07:13.590 --> 07:15.270 align:middle line:90%
And the interface
we want to use is

196
07:15.270 --> 07:18.360 align:middle line:84%
eth0 for ethernet zero space.

197
07:18.360 --> 07:21.000 align:middle line:90%
And for the number,
let's just send in '10.

198
07:21.000 --> 07:22.400 align:middle line:84%
Let's not get too crazy.

199
07:22.400 --> 07:24.570 align:middle line:84%
So we'll do a -n, space, '10.

200
07:24.570 --> 07:26.070 align:middle line:84%
Press Enter.

201
07:26.070 --> 07:28.050 align:middle line:84%
And it sent those 10n.

202
07:28.050 --> 07:30.960 align:middle line:90%
If you go back to DCNUG,
I'm expecting that we
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

202
07:28.050 --> 07:30.960 align:middle line:90%
If you go back to DCNUG,
I'm expecting that we

203
07:30.960 --> 07:33.180 align:middle line:84%
have a port security violation.

204
07:33.180 --> 07:33.860 align:middle line:84%
Here it is.

205
07:33.860 --> 07:35.820 align:middle line:90%
And it's caused by
that Mac address.

206
07:35.820 --> 07:38.040 align:middle line:90%
That must mean the
sixth one as seen

207
07:38.040 --> 07:40.050 align:middle line:84%
by the switch on that port.

208
07:40.050 --> 07:43.000 align:middle line:90%
And as a result, the
interface is now set to down.

209
07:43.000 --> 07:48.000 align:middle line:90%
And if we do a show interface
status, and then error disable,

210
07:48.000 --> 07:50.127 align:middle line:90%
enter, that'll show
us all the interfaces

211
07:50.127 --> 07:51.960 align:middle line:90%
that are currently in
an error disable state

212
07:51.960 --> 07:53.670 align:middle line:84%
and also what caused it.

213
07:53.670 --> 07:56.790 align:middle line:90%
So 0/0 is error disabled due
to ports curfew violation.

214
07:56.790 --> 07:57.960 align:middle line:84%
And there it stays.

215
07:57.960 --> 08:00.300 align:middle line:90%
And so that the port sits
in error disabled state.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

215
07:57.960 --> 08:00.300 align:middle line:90%
And so that the port sits
in error disabled state.

216
08:00.300 --> 08:03.988 align:middle line:90%
Now it's a bummer because this
requires by default manual

217
08:03.988 --> 08:04.530 align:middle line:84%
intervention.

218
08:04.530 --> 08:05.730 align:middle line:84%
We've got to go in.

219
08:05.730 --> 08:07.210 align:middle line:84%
We've got to shut down the port.

220
08:07.210 --> 08:09.388 align:middle line:90%
We've got to do a no
shut to bring it back up.

221
08:09.388 --> 08:11.180 align:middle line:90%
And then that port can
start working again.

222
08:11.180 --> 08:13.350 align:middle line:90%
But the moment that
port security violation

223
08:13.350 --> 08:16.060 align:middle line:90%
happens again, it's going
to shut down the port.

224
08:16.060 --> 08:19.110 align:middle line:90%
So let's solve that problem
now by doing a shut and no shut

225
08:19.110 --> 08:21.990 align:middle line:90%
for that gig 0/0 interface,
which will clear the air

226
08:21.990 --> 08:23.145 align:middle line:84%
and bring the port up.

227
08:23.145 --> 08:25.562 align:middle line:90%
So to do that, we're going to
interface configuration mode

228
08:25.562 --> 08:28.010 align:middle line:84%
for interface gig 0/0.

229
08:28.010 --> 08:29.970 align:middle line:84%
And we'll do a shutdown.

230
08:29.970 --> 08:32.880 align:middle line:84%
And then we'll do a no shutdown.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

230
08:29.970 --> 08:32.880 align:middle line:84%
And then we'll do a no shutdown.

231
08:32.880 --> 08:34.380 align:middle line:90%
And then if he has
the upper command

232
08:34.380 --> 08:37.950 align:middle line:90%
a few times to show interface
status for error disabled,

233
08:37.950 --> 08:39.929 align:middle line:84%
it's no longer error disabled.

234
08:39.929 --> 08:42.780 align:middle line:90%
And also if we go back
to the Kali Linux box,

235
08:42.780 --> 08:45.450 align:middle line:90%
and instead of doing some
crazy Mac off attack,

236
08:45.450 --> 08:47.700 align:middle line:90%
we just do a simple
ping again, our traffic

237
08:47.700 --> 08:50.080 align:middle line:90%
can once again be
able to go through.

238
08:50.080 --> 08:52.605 align:middle line:90%
So now that that switch port
is up and running again,

239
08:52.605 --> 08:54.480 align:middle line:90%
if there is another port
security violation--

240
08:54.480 --> 08:57.120 align:middle line:90%
meaning going above the five
number mark for source Mac

241
08:57.120 --> 08:58.500 align:middle line:84%
addresses--

242
08:58.500 --> 09:00.180 align:middle line:84%
it was at that port down again.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

242
08:58.500 --> 09:00.180 align:middle line:84%
it was at that port down again.

243
09:00.180 --> 09:01.830 align:middle line:90%
In the next video,
what I'd like to do

244
09:01.830 --> 09:04.650 align:middle line:90%
is walk you through
an automated method

245
09:04.650 --> 09:06.280 align:middle line:90%
where we can train
the switch, hey,

246
09:06.280 --> 09:09.660 align:middle line:90%
if there's a port security
violation, wait 30 seconds,

247
09:09.660 --> 09:10.982 align:middle line:84%
and then bring it back up.

248
09:10.982 --> 09:13.190 align:middle line:90%
And then if there's another
violation, bring it down.

249
09:13.190 --> 09:15.990 align:middle line:90%
And that way, we can have it--
like after the short time out--

250
09:15.990 --> 09:19.200 align:middle line:90%
bring up a port automatically
from a shutdown state

251
09:19.200 --> 09:20.900 align:middle line:90%
if there's a port
security violation.

252
09:20.900 --> 09:22.980 align:middle line:90%
At the same time, we
can look at our logs,

253
09:22.980 --> 09:24.632 align:middle line:90%
get the messages
that it's happening,

254
09:24.632 --> 09:25.590 align:middle line:84%
and we can research it.

255
09:25.590 --> 09:28.230 align:middle line:90%
But it means we don't
have to come in at 2:00 AM

256
09:28.230 --> 09:30.540 align:middle line:90%
in the morning or some
other inconvenient time
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

256
09:28.230 --> 09:30.540 align:middle line:90%
in the morning or some
other inconvenient time

257
09:30.540 --> 09:33.410 align:middle line:90%
to manually bring a port out
of an error disabled state.

258
09:33.410 --> 09:35.470 align:middle line:90%
So we'll cover all
that in the next video.

259
09:35.470 --> 09:37.920 align:middle line:90%
Meanwhile, I hope this has
been informative for you,

260
09:37.920 --> 09:41.030 align:middle line:90%
and I'd like to thank
you for viewing.