WEBVTT

1
00:00.000 --> 00:00.600 align:middle line:84%


2
00:00.600 --> 00:03.300 align:middle line:90%
Like many people, I'm a
big believer in security.

3
00:03.300 --> 00:05.923 align:middle line:90%
When I was a young father and
our kids were really young,

4
00:05.923 --> 00:07.590 align:middle line:90%
one of the techniques
that we discovered

5
00:07.590 --> 00:10.417 align:middle line:90%
was that you don't want
the kids, the young kids,

6
00:10.417 --> 00:12.000 align:middle line:90%
like three and four
years old, opening

7
00:12.000 --> 00:13.420 align:middle line:84%
the front door for people.

8
00:13.420 --> 00:16.920 align:middle line:90%
So to accomplish that
goal, we had a lock

9
00:16.920 --> 00:18.837 align:middle line:84%
that used a key on both sides.

10
00:18.837 --> 00:20.670 align:middle line:90%
So there wasn't just a
knob you could twist.

11
00:20.670 --> 00:21.795 align:middle line:84%
You'd have to have the key.

12
00:21.795 --> 00:26.370 align:middle line:90%
Now that's good for security
because the kid without the key

13
00:26.370 --> 00:29.250 align:middle line:90%
can't accidentally or playing
around open that door,

14
00:29.250 --> 00:32.210 align:middle line:90%
but it's a pain in the rear if
there's somebody at the door
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

14
00:29.250 --> 00:32.210 align:middle line:90%
but it's a pain in the rear if
there's somebody at the door

15
00:32.210 --> 00:34.585 align:middle line:90%
and you need to open it and
you don't have the key handy.

16
00:34.585 --> 00:35.377 align:middle line:84%
It's an extra step.

17
00:35.377 --> 00:36.835 align:middle line:90%
So we have a similar
thing going on

18
00:36.835 --> 00:38.160 align:middle line:84%
with port security violations.

19
00:38.160 --> 00:40.110 align:middle line:90%
Because if a port
security violation puts

20
00:40.110 --> 00:42.600 align:middle line:90%
a port in error-disabled
state and then it

21
00:42.600 --> 00:45.945 align:middle line:90%
takes a human like us to
connect, log in, and do

22
00:45.945 --> 00:47.820 align:middle line:90%
a shut down and no shut
down on the interface

23
00:47.820 --> 00:50.010 align:middle line:90%
to bring it back up,
that's extra work.

24
00:50.010 --> 00:52.610 align:middle line:90%
If it happens two or three
or four or five times a day,

25
00:52.610 --> 00:54.360 align:middle line:90%
even if it's accidental,
it takes overhead

26
00:54.360 --> 00:55.580 align:middle line:84%
to get that corrected.

27
00:55.580 --> 00:58.110 align:middle line:90%
So wouldn't it be
great if we could

28
00:58.110 --> 01:01.230 align:middle line:90%
have the switch look at
port security violations
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

28
00:58.110 --> 01:01.230 align:middle line:90%
have the switch look at
port security violations

29
01:01.230 --> 01:02.110 align:middle line:84%
that happen.

30
01:02.110 --> 01:04.290 align:middle line:90%
And if the port goes
down, if it's shut down

31
01:04.290 --> 01:06.090 align:middle line:90%
because of a port
security violation,

32
01:06.090 --> 01:09.570 align:middle line:90%
to wait a period of time, like
30 seconds or a few minutes,

33
01:09.570 --> 01:11.160 align:middle line:84%
and then bring it back up.

34
01:11.160 --> 01:12.308 align:middle line:84%
That's a good idea.

35
01:12.308 --> 01:14.850 align:middle line:90%
Now the great news is this-- if
the system brings up the port

36
01:14.850 --> 01:17.010 align:middle line:90%
after a short time
out, if whatever

37
01:17.010 --> 01:19.860 align:middle line:90%
was causing that port security
violation is still going on,

38
01:19.860 --> 01:22.300 align:middle line:90%
there's too many MAC
addresses, the switch will,

39
01:22.300 --> 01:24.570 align:middle line:90%
boom, put it back
in shut down state,

40
01:24.570 --> 01:26.730 align:middle line:90%
then wait the time out
again then bring it up.

41
01:26.730 --> 01:28.470 align:middle line:90%
So we're still
protecting the network,

42
01:28.470 --> 01:30.670 align:middle line:90%
but we don't have to
manually get involved
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

42
01:28.470 --> 01:30.670 align:middle line:90%
but we don't have to
manually get involved

43
01:30.670 --> 01:32.850 align:middle line:90%
every time we want to
bring a port back up out

44
01:32.850 --> 01:35.785 align:middle line:90%
of an error-disabled state if
it was due to port security.

45
01:35.785 --> 01:37.160 align:middle line:90%
So what I'd like
to do in the lab

46
01:37.160 --> 01:39.960 align:middle line:90%
is walk you through setting
up that error recovery

47
01:39.960 --> 01:42.270 align:middle line:90%
automatically for port
security violations.

48
01:42.270 --> 01:44.770 align:middle line:90%
And we'll do that in
the lab right now.

49
01:44.770 --> 01:45.960 align:middle line:84%
So here we are in DC-NUG.

50
01:45.960 --> 01:48.072 align:middle line:90%
We'll open up a PuTTY
session and we'll

51
01:48.072 --> 01:49.530 align:middle line:90%
go ahead and open
a connection over

52
01:49.530 --> 01:51.990 align:middle line:84%
to access switch number one.

53
01:51.990 --> 01:53.108 align:middle line:84%
So I reset the lab.

54
01:53.108 --> 01:54.900 align:middle line:90%
So let's take a look
at a few of the basics

55
01:54.900 --> 01:56.067 align:middle line:84%
before we start configuring.

56
01:56.067 --> 01:57.950 align:middle line:84%
We'll do a show VLAN brief.

57
01:57.950 --> 02:01.570 align:middle line:90%
That will help us verify whether
or not gig 00 is in VLAN 10.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

57
01:57.950 --> 02:01.570 align:middle line:90%
That will help us verify whether
or not gig 00 is in VLAN 10.

58
02:01.570 --> 02:02.070 align:middle line:84%
It is.

59
02:02.070 --> 02:03.400 align:middle line:84%
Fantastic.

60
02:03.400 --> 02:05.520 align:middle line:90%
Let's also issue the
command show port security,

61
02:05.520 --> 02:07.830 align:middle line:90%
see if any ports on the
switch are currently

62
02:07.830 --> 02:09.889 align:middle line:90%
configured for port
security, and they're not.

63
02:09.889 --> 02:14.430 align:middle line:90%
So we'll go into configuration
mode, interface gig 0/0,

64
02:14.430 --> 02:16.662 align:middle line:90%
and let's use the
command switchport post.

65
02:16.662 --> 02:18.870 align:middle line:90%
And that's going to do a
few things for us, including

66
02:18.870 --> 02:21.540 align:middle line:90%
confirming that we're
not a dynamic port,

67
02:21.540 --> 02:23.220 align:middle line:84%
we're now an access port.

68
02:23.220 --> 02:25.980 align:middle line:90%
We already looked at the fact
that this port is in VLAN 10.

69
02:25.980 --> 02:28.650 align:middle line:90%
And let's set a couple
parameters for port security

70
02:28.650 --> 02:29.900 align:middle line:84%
before we enable the feature.

71
02:29.900 --> 02:32.280 align:middle line:90%
So we'll do a switchport
port security,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

71
02:29.900 --> 02:32.280 align:middle line:90%
So we'll do a switchport
port security,

72
02:32.280 --> 02:34.460 align:middle line:84%
and let's set the max to--

73
02:34.460 --> 02:35.910 align:middle line:84%
let's go ahead and put in five.

74
02:35.910 --> 02:36.840 align:middle line:84%
That'll work.

75
02:36.840 --> 02:39.340 align:middle line:90%
And the default violation
is going to be shut down,

76
02:39.340 --> 02:40.750 align:middle line:84%
and so we'll leave that alone.

77
02:40.750 --> 02:44.170 align:middle line:90%
And then we'll do switchport
port security all by itself,

78
02:44.170 --> 02:46.840 align:middle line:90%
and this is the command that's
going to enable the feature.

79
02:46.840 --> 02:53.220 align:middle line:90%
So if we do a show port-security
for interface gig 0/0,

80
02:53.220 --> 02:54.595 align:middle line:90%
we can confirm
that it's enabled.

81
02:54.595 --> 02:57.380 align:middle line:84%
So port-security is enabled.

82
02:57.380 --> 02:59.590 align:middle line:90%
The violation mode is
going to be shutdown.

83
02:59.590 --> 03:01.720 align:middle line:84%
Maximum MAC addresses is five.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

83
02:59.590 --> 03:01.720 align:middle line:84%
Maximum MAC addresses is five.

84
03:01.720 --> 03:03.130 align:middle line:84%
That all looks great.

85
03:03.130 --> 03:05.230 align:middle line:90%
So let's trigger a
violation by going over

86
03:05.230 --> 03:07.430 align:middle line:84%
to our Kali Linux machine.

87
03:07.430 --> 03:09.890 align:middle line:90%
And here on the Kali Linux
machine we'll log on as root

88
03:09.890 --> 03:13.820 align:middle line:90%
with the password of T-O-O-R,
which is root backwards.

89
03:13.820 --> 03:15.990 align:middle line:90%
And we'll open up
a terminal session.

90
03:15.990 --> 03:19.220 align:middle line:90%
And we'll use this icon over
here to open up a terminal.

91
03:19.220 --> 03:20.660 align:middle line:84%
Fantabulous.

92
03:20.660 --> 03:24.680 align:middle line:90%
And let's go ahead
and do a macof, space,

93
03:24.680 --> 03:27.300 align:middle line:90%
and we'll do a dash
i for interface.

94
03:27.300 --> 03:30.350 align:middle line:90%
And I suppose we want to use
Ethernet zero on this Kali
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

94
03:27.300 --> 03:30.350 align:middle line:90%
And I suppose we want to use
Ethernet zero on this Kali

95
03:30.350 --> 03:33.630 align:middle line:90%
Linux box, and then
dash n for the number.

96
03:33.630 --> 03:37.795 align:middle line:90%
And let's just go
ahead and let's do 20.

97
03:37.795 --> 03:38.920 align:middle line:84%
That's going to trigger it.

98
03:38.920 --> 03:42.200 align:middle line:90%
So we just sent 20 frames in all
with spoofed and bogus source

99
03:42.200 --> 03:43.260 align:middle line:84%
MAC addresses.

100
03:43.260 --> 03:46.550 align:middle line:90%
And let's go take a look
at our CLI on our admin PC.

101
03:46.550 --> 03:49.920 align:middle line:90%
So sure enough, there is
our port security violation.

102
03:49.920 --> 03:55.295 align:middle line:90%
And now if we do a show
interface status, space E-R-R,

103
03:55.295 --> 03:57.980 align:middle line:90%
and press Enter,
it's going to show us

104
03:57.980 --> 04:00.770 align:middle line:90%
all the ports that are currently
in an error-disabled state.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

104
03:57.980 --> 04:00.770 align:middle line:90%
all the ports that are currently
in an error-disabled state.

105
04:00.770 --> 04:04.673 align:middle line:90%
And that includes gig 00, and
it also shows the reason for it.

106
04:04.673 --> 04:06.590 align:middle line:90%
So I'm going to get out
of configuration mode,

107
04:06.590 --> 04:07.340 align:middle line:84%
and let's do this.

108
04:07.340 --> 04:11.500 align:middle line:90%
Let's do a show
error-disabled recovery.

109
04:11.500 --> 04:12.243 align:middle line:84%
Just like that.

110
04:12.243 --> 04:13.660 align:middle line:90%
And that command
right there, I'll

111
04:13.660 --> 04:15.880 align:middle line:90%
highlight it, show
error-disabled recovery,

112
04:15.880 --> 04:17.320 align:middle line:90%
is going to show
us whether or not

113
04:17.320 --> 04:21.430 align:middle line:90%
we have auto recovery regarding
error-disabled ports based

114
04:21.430 --> 04:24.730 align:middle line:90%
on the reason they went into
an error-disabled state.

115
04:24.730 --> 04:27.500 align:middle line:90%
And right here, this guy
right here, psecure violation,

116
04:27.500 --> 04:30.310 align:middle line:90%
is port security, and
the automatic recovery
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

116
04:27.500 --> 04:30.310 align:middle line:90%
is port security, and
the automatic recovery

117
04:30.310 --> 04:32.650 align:middle line:90%
has been disabled for
it as is by default

118
04:32.650 --> 04:34.012 align:middle line:84%
for all of these other reasons.

119
04:34.012 --> 04:36.220 align:middle line:90%
So what we could do is we
could just tell the switch,

120
04:36.220 --> 04:37.070 align:middle line:84%
hey, listen.

121
04:37.070 --> 04:39.610 align:middle line:90%
If there's a port security
violation and that's

122
04:39.610 --> 04:41.800 align:middle line:90%
why it's in their disabled
state, let's go ahead

123
04:41.800 --> 04:45.050 align:middle line:90%
and have you, after a short
time out, bring it back up.

124
04:45.050 --> 04:47.050 align:middle line:90%
So to do that, we'll go
to configuration mode.

125
04:47.050 --> 04:51.280 align:middle line:90%
And in configuration we'll use
the command errdisable recovery

126
04:51.280 --> 04:54.820 align:middle line:84%
cause, and then we'll specify p.

127
04:54.820 --> 04:56.320 align:middle line:90%
And p is not unique,
because there's

128
04:56.320 --> 04:58.820 align:middle line:90%
a few things that start with
p, so we'll do a question mark.

129
04:58.820 --> 05:01.000 align:middle line:84%
And there is psecure violation.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

129
04:58.820 --> 05:01.000 align:middle line:84%
And there is psecure violation.

130
05:01.000 --> 05:01.690 align:middle line:84%
There you go.

131
05:01.690 --> 05:03.080 align:middle line:84%
We can tab that out.

132
05:03.080 --> 05:04.690 align:middle line:90%
We can also specify
how long we want

133
05:04.690 --> 05:06.970 align:middle line:90%
the timeout to be
before it recovers

134
05:06.970 --> 05:08.630 align:middle line:84%
or brings that port back up.

135
05:08.630 --> 05:11.440 align:middle line:90%
So if we use the command
errdisable recovery again

136
05:11.440 --> 05:14.620 align:middle line:90%
and interval, we can go ahead
and specify how many seconds.

137
05:14.620 --> 05:19.060 align:middle line:90%
And so the range is 30 to 86,400
seconds, which is a full day.

138
05:19.060 --> 05:20.560 align:middle line:90%
So if we wanted it
to be 30 seconds,

139
05:20.560 --> 05:22.690 align:middle line:90%
we can put 30 in
there, press Enter.

140
05:22.690 --> 05:25.950 align:middle line:90%
And then if we use the show
command for show errdisable

141
05:25.950 --> 05:28.870 align:middle line:90%
recovery, now the
recovery is enabled

142
05:28.870 --> 05:32.230 align:middle line:90%
if a port is in error-disabled
state based on a port security
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

142
05:28.870 --> 05:32.230 align:middle line:90%
if a port is in error-disabled
state based on a port security

143
05:32.230 --> 05:33.350 align:middle line:84%
violation.

144
05:33.350 --> 05:36.280 align:middle line:90%
And this is also showing
how much time is left.

145
05:36.280 --> 05:38.470 align:middle line:90%
Now this is showing
281 seconds left,

146
05:38.470 --> 05:40.630 align:middle line:90%
and that's because
this happened before I

147
05:40.630 --> 05:42.190 align:middle line:84%
modified the timer to 30.

148
05:42.190 --> 05:44.440 align:middle line:90%
So from this point going
forward the new violation

149
05:44.440 --> 05:46.070 align:middle line:84%
will only take 30 seconds.

150
05:46.070 --> 05:47.530 align:middle line:84%
So we can actually force that.

151
05:47.530 --> 05:51.783 align:middle line:90%
Let's go ahead and go into
interface for gig 0/0,

152
05:51.783 --> 05:53.200 align:middle line:90%
and I'll take off
that nine there.

153
05:53.200 --> 05:54.220 align:middle line:84%
00, there we go.

154
05:54.220 --> 05:57.350 align:middle line:90%
We'll do a shutdown
and a no shutdown.

155
05:57.350 --> 05:59.600 align:middle line:90%
That's going to remove
the error-disabled state

156
05:59.600 --> 06:01.450 align:middle line:90%
so the port's up
and happy, happy.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

156
05:59.600 --> 06:01.450 align:middle line:90%
so the port's up
and happy, happy.

157
06:01.450 --> 06:04.510 align:middle line:90%
Let's go back to our Kali
Linux box and what we'll do

158
06:04.510 --> 06:05.950 align:middle line:84%
is we'll just trigger it again.

159
06:05.950 --> 06:08.800 align:middle line:90%
So from Kali Linux we'll
just send 20 more in.

160
06:08.800 --> 06:11.080 align:middle line:90%
That should trigger
a new port security

161
06:11.080 --> 06:12.880 align:middle line:84%
violation, which it just did.

162
06:12.880 --> 06:14.600 align:middle line:84%
Fantastic.

163
06:14.600 --> 06:17.140 align:middle line:90%
And now if we use the command
show errdisable recovery,

164
06:17.140 --> 06:20.770 align:middle line:90%
we press Enter, we can see
here the psecure violation

165
06:20.770 --> 06:23.020 align:middle line:90%
is enabled, so it's going
to auto recover that for us.

166
06:23.020 --> 06:24.050 align:middle line:84%
But check this out.

167
06:24.050 --> 06:25.810 align:middle line:90%
If we hit the spacebar
it's now showing us

168
06:25.810 --> 06:27.440 align:middle line:84%
how many seconds we have left.

169
06:27.440 --> 06:30.610 align:middle line:90%
So in 20 seconds it's going
to bring that port back up
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

169
06:27.440 --> 06:30.610 align:middle line:90%
So in 20 seconds it's going
to bring that port back up

170
06:30.610 --> 06:32.630 align:middle line:84%
automatically by itself.

171
06:32.630 --> 06:35.030 align:middle line:90%
And if whoever's playing
shenanigans off of gig 00

172
06:35.030 --> 06:37.840 align:middle line:90%
continues to play
those shenanigans,

173
06:37.840 --> 06:40.990 align:middle line:90%
it would cause the port to go
into error-disabled state again

174
06:40.990 --> 06:43.820 align:middle line:90%
based on yet another
port security violation.

175
06:43.820 --> 06:48.380 align:middle line:90%
So if we hit the up arrow
key and hit spacebar,

176
06:48.380 --> 06:50.540 align:middle line:84%
there's two seconds left.

177
06:50.540 --> 06:52.650 align:middle line:84%
It's going to be fantastic.

178
06:52.650 --> 06:54.753 align:middle line:84%
And there's our console message.

179
06:54.753 --> 06:55.920 align:middle line:84%
And now the interface is up.

180
06:55.920 --> 07:00.290 align:middle line:90%
And if you do a show interface
status and then E-R-R and hit
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

180
06:55.920 --> 07:00.290 align:middle line:90%
And if you do a show interface
status and then E-R-R and hit

181
07:00.290 --> 07:03.650 align:middle line:90%
Tab, now we currently don't have
any ports in an error-disabled

182
07:03.650 --> 07:07.730 align:middle line:90%
state because gig 00 was
brought up automagically with

183
07:07.730 --> 07:09.573 align:middle line:84%
error-disabled recovery.

184
07:09.573 --> 07:11.240 align:middle line:90%
So this video, we've
had the opportunity

185
07:11.240 --> 07:14.270 align:middle line:90%
to practice once again with
implementing port security,

186
07:14.270 --> 07:16.830 align:middle line:90%
and then in addition taking
a look at how we can set up

187
07:16.830 --> 07:18.860 align:middle line:90%
error-disabled
recovery automatically

188
07:18.860 --> 07:22.250 align:middle line:90%
after a period of time for ports
that were brought down because

189
07:22.250 --> 07:24.042 align:middle line:84%
of a port security violation.

190
07:24.042 --> 07:26.000 align:middle line:90%
So thanks for joining me
in this video and lab,

191
07:26.000 --> 07:27.900 align:middle line:90%
and I'll see you
in the next one.

192
07:27.900 --> 07:30.320 align:middle line:90%
Meanwhile, I hope this has
been informative for you
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

192
07:27.900 --> 07:30.320 align:middle line:90%
Meanwhile, I hope this has
been informative for you

193
07:30.320 --> 07:33.580 align:middle line:90%
and I'd like to thank
you for viewing.