WEBVTT

1
00:00.000 --> 00:00.620 align:middle line:84%


2
00:00.620 --> 00:02.382 align:middle line:90%
Well, my friend,
it is that time.

3
00:02.382 --> 00:04.590 align:middle line:90%
You may be saying, Keith,
what do you mean that time?

4
00:04.590 --> 00:07.670 align:middle line:90%
It is time to apply our
skills that we have practiced

5
00:07.670 --> 00:09.530 align:middle line:90%
and worked up to
with port security

6
00:09.530 --> 00:11.490 align:middle line:84%
to the production network.

7
00:11.490 --> 00:13.340 align:middle line:90%
So to do that, we've
got a call from Bob.

8
00:13.340 --> 00:14.840 align:middle line:84%
We're meeting him in his office.

9
00:14.840 --> 00:16.520 align:middle line:90%
And here is what
he'd like to do.

10
00:16.520 --> 00:18.110 align:middle line:84%
And he'd like our help.

11
00:18.110 --> 00:20.960 align:middle line:90%
And my question for
you is, are you in?

12
00:20.960 --> 00:21.530 align:middle line:84%
Awesome.

13
00:21.530 --> 00:22.820 align:middle line:84%
Let's go talk to Bob.

14
00:22.820 --> 00:24.920 align:middle line:90%
So we meet with Bob, and
here's what he asks us.

15
00:24.920 --> 00:28.220 align:middle line:90%
He says, first of all, is it
possible to go ahead and do

16
00:28.220 --> 00:32.420 align:middle line:90%
port security to limit the
number of MAC addresses learned
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

16
00:28.220 --> 00:32.420 align:middle line:90%
port security to limit the
number of MAC addresses learned

17
00:32.420 --> 00:36.110 align:middle line:90%
on an interface on a switch,
even if it's a trunk interface?

18
00:36.110 --> 00:38.120 align:middle line:90%
And so we tell him,
here's how it works.

19
00:38.120 --> 00:40.400 align:middle line:90%
To use port security,
we just cannot--

20
00:40.400 --> 00:43.010 align:middle line:90%
I repeat not-- have
a dynamic port.

21
00:43.010 --> 00:44.360 align:middle line:84%
We have to specify.

22
00:44.360 --> 00:46.940 align:middle line:90%
You are an access port,
switch port mode access.

23
00:46.940 --> 00:49.700 align:middle line:90%
Or you are a trunk port,
switch port mode trunk.

24
00:49.700 --> 00:52.550 align:middle line:90%
So as long as we're hard-coding
those configurations

25
00:52.550 --> 00:55.250 align:middle line:90%
as an access port
or a trunk port,

26
00:55.250 --> 00:57.740 align:middle line:90%
we can use port security on
either one of those layer 2

27
00:57.740 --> 00:59.120 align:middle line:84%
interface types.

28
00:59.120 --> 01:00.390 align:middle line:84%
So he says to us, great!
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

28
00:59.120 --> 01:00.390 align:middle line:84%
So he says to us, great!

29
01:00.390 --> 01:01.473 align:middle line:84%
That's what we want to do.

30
01:01.473 --> 01:03.874 align:middle line:90%
We want to make sure that on
this trunk link from core 1

31
01:03.874 --> 01:06.950 align:middle line:90%
up to the access layer
switch, which is gig 1/0,

32
01:06.950 --> 01:10.995 align:middle line:90%
and on core 2, this trunk link,
2/2, up to the access layer

33
01:10.995 --> 01:12.620 align:middle line:90%
switch, we want to
make sure that we're

34
01:12.620 --> 01:13.860 align:middle line:84%
enabling port security.

35
01:13.860 --> 01:16.310 align:middle line:90%
And if there's a violation,
meaning we go to 2001

36
01:16.310 --> 01:18.830 align:middle line:90%
or higher, we want the port
security violation action

37
01:18.830 --> 01:22.280 align:middle line:90%
to be protect, as in
not shut down the trunk,

38
01:22.280 --> 01:26.060 align:middle line:90%
but just protect, and not allow
any additional MAC addresses

39
01:26.060 --> 01:28.280 align:middle line:84%
above and beyond the 2,000.

40
01:28.280 --> 01:30.770 align:middle line:90%
So before we begin, we ask
him a couple more questions.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

40
01:28.280 --> 01:30.770 align:middle line:90%
So before we begin, we ask
him a couple more questions.

41
01:30.770 --> 01:33.620 align:middle line:90%
We say, Bob, are those
trunks specifically set up

42
01:33.620 --> 01:36.770 align:middle line:90%
as trunks with switchport mode
trunks so they're not dynamic?

43
01:36.770 --> 01:39.120 align:middle line:90%
He says, yes, that's
already in place.

44
01:39.120 --> 01:42.260 align:middle line:90%
So the logical order we should
approach this in is setting up

45
01:42.260 --> 01:44.870 align:middle line:90%
the maximum MAC
addresses to 2,000

46
01:44.870 --> 01:47.360 align:middle line:90%
before we enable the feature,
because the default is 1.

47
01:47.360 --> 01:48.630 align:middle line:84%
That might be a problem.

48
01:48.630 --> 01:50.255 align:middle line:90%
And then the second
thing we want to do

49
01:50.255 --> 01:52.250 align:middle line:90%
is also specify the
violation action, which

50
01:52.250 --> 01:53.630 align:middle line:84%
is going to be to protect.

51
01:53.630 --> 01:55.490 align:middle line:90%
And that order
absolutely matters,

52
01:55.490 --> 01:58.430 align:middle line:90%
because we want the 2,000
parameter for MAC addresses

53
01:58.430 --> 02:02.180 align:middle line:90%
and the violation action
to be in place before we
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

53
01:58.430 --> 02:02.180 align:middle line:90%
and the violation action
to be in place before we

54
02:02.180 --> 02:03.320 align:middle line:84%
flip the switch--

55
02:03.320 --> 02:05.040 align:middle line:90%
pun intended-- we
flip the switch

56
02:05.040 --> 02:07.730 align:middle line:90%
and do switchport port
security to enable the feature

57
02:07.730 --> 02:09.259 align:middle line:84%
on those two interfaces.

58
02:09.259 --> 02:11.690 align:middle line:90%
So with that plan in place,
let's take one more quick look

59
02:11.690 --> 02:12.780 align:middle line:84%
at our topology.

60
02:12.780 --> 02:16.303 align:middle line:90%
We'll go configure core 1
and core 2 respectively.

61
02:16.303 --> 02:18.470 align:middle line:90%
So just as a reminder,
here's the ports we're after.

62
02:18.470 --> 02:21.380 align:middle line:90%
We can also verify that
those are the ports that

63
02:21.380 --> 02:23.030 align:middle line:90%
lead up to this
access layer switch

64
02:23.030 --> 02:25.190 align:middle line:90%
by doing a show CDP
neighbor as well.

65
02:25.190 --> 02:26.430 align:middle line:84%
And that's a good idea.

66
02:26.430 --> 02:28.170 align:middle line:90%
So let's go to our
admin computer.

67
02:28.170 --> 02:30.470 align:middle line:90%
And we'll get consoles
to core 1 and core 2.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

67
02:28.170 --> 02:30.470 align:middle line:90%
And we'll get consoles
to core 1 and core 2.

68
02:30.470 --> 02:32.280 align:middle line:90%
And we'll start
our configuration.

69
02:32.280 --> 02:34.900 align:middle line:90%
So we'll launch MTPuTTY,
upper left-hand corner.

70
02:34.900 --> 02:36.240 align:middle line:84%
Go to Servers.

71
02:36.240 --> 02:37.860 align:middle line:90%
And we'll get a
connection to core.

72
02:37.860 --> 02:39.980 align:middle line:90%
And we'll get one more
connection to core 2.

73
02:39.980 --> 02:41.040 align:middle line:84%
Good to go.

74
02:41.040 --> 02:42.450 align:middle line:84%
So let's start on core 1.

75
02:42.450 --> 02:44.270 align:middle line:90%
Let's just verify
our connections

76
02:44.270 --> 02:46.340 align:middle line:84%
with the show CDP neighbor.

77
02:46.340 --> 02:49.920 align:middle line:90%
So from core 1's perspective,
our local interface, gig 1/0,

78
02:49.920 --> 02:51.770 align:middle line:84%
does indeed go up to access 1.

79
02:51.770 --> 02:53.160 align:middle line:84%
So that's correct.

80
02:53.160 --> 02:56.720 align:middle line:90%
And let's also do a
show port security just

81
02:56.720 --> 02:59.520 align:middle line:90%
to make sure that before we
start configuring it's not

82
02:59.520 --> 03:00.770 align:middle line:84%
already in place somewhere.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

82
02:59.520 --> 03:00.770 align:middle line:84%
already in place somewhere.

83
03:00.770 --> 03:02.540 align:middle line:90%
So we'll do a show
port security.

84
03:02.540 --> 03:03.940 align:middle line:84%
Not enabled anywhere.

85
03:03.940 --> 03:04.440 align:middle line:84%
Great.

86
03:04.440 --> 03:08.070 align:middle line:90%
Let's go to interface
configuration mode for gig 1/0.

87
03:08.070 --> 03:10.310 align:middle line:90%
So we'll go to
interface gig 1/0.

88
03:10.310 --> 03:12.480 align:middle line:90%
And we'll do a
switchport port security.

89
03:12.480 --> 03:14.330 align:middle line:90%
And we're not going
to press Enter,

90
03:14.330 --> 03:16.790 align:middle line:90%
because if we did
right now, we'd

91
03:16.790 --> 03:19.760 align:middle line:90%
be enabling port security with
a maximum MAC address of 1.

92
03:19.760 --> 03:21.720 align:middle line:90%
And that would be
a huge problem.

93
03:21.720 --> 03:23.755 align:middle line:84%
So we're going to specify max.

94
03:23.755 --> 03:25.880 align:middle line:90%
And then we'll put it in
the number of 2,000, which

95
03:25.880 --> 03:27.410 align:middle line:84%
is what they're looking for.

96
03:27.410 --> 03:30.290 align:middle line:90%
Let's also do a
switchport port security.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

96
03:27.410 --> 03:30.290 align:middle line:90%
Let's also do a
switchport port security.

97
03:30.290 --> 03:32.270 align:middle line:90%
And we'll specify
the violation action,

98
03:32.270 --> 03:34.700 align:middle line:84%
which they asked for protect.

99
03:34.700 --> 03:35.473 align:middle line:84%
Great.

100
03:35.473 --> 03:36.890 align:middle line:90%
And then third
thing we want to do

101
03:36.890 --> 03:38.550 align:middle line:84%
is enable it on the interface.

102
03:38.550 --> 03:41.030 align:middle line:90%
So we'll do a switchport
port security.

103
03:41.030 --> 03:41.990 align:middle line:84%
Press Enter.

104
03:41.990 --> 03:42.950 align:middle line:84%
And now it's enabled.

105
03:42.950 --> 03:44.300 align:middle line:84%
Now we can verify our work.

106
03:44.300 --> 03:46.280 align:middle line:84%
Say show port security.

107
03:46.280 --> 03:47.460 align:middle line:84%
Press Enter.

108
03:47.460 --> 03:47.960 align:middle line:84%
Great.

109
03:47.960 --> 03:51.740 align:middle line:90%
Gig 1/0, the MAC
address is 2,000.

110
03:51.740 --> 03:53.300 align:middle line:90%
And the security
action of protect.

111
03:53.300 --> 03:53.800 align:middle line:84%
OK.

112
03:53.800 --> 03:55.758 align:middle line:90%
Let's do that same command,
show port security,

113
03:55.758 --> 03:58.100 align:middle line:84%
for interface gig 1/0.

114
03:58.100 --> 04:01.100 align:middle line:90%
See the details specifically
on that interface.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

114
03:58.100 --> 04:01.100 align:middle line:90%
See the details specifically
on that interface.

115
04:01.100 --> 04:02.170 align:middle line:84%
Fantastic.

116
04:02.170 --> 04:04.340 align:middle line:84%
One trunk port down, one to go.

117
04:04.340 --> 04:06.020 align:middle line:84%
Let's go over to core 2.

118
04:06.020 --> 04:08.303 align:middle line:90%
So on core 2, we'll also do
a show port security just

119
04:08.303 --> 04:10.220 align:middle line:90%
to make sure we know
what we're starting with.

120
04:10.220 --> 04:11.000 align:middle line:84%
Great.

121
04:11.000 --> 04:12.917 align:middle line:90%
We'll also do a show
CDP neighbor just

122
04:12.917 --> 04:14.750 align:middle line:90%
to make sure we're on
the correct interface,

123
04:14.750 --> 04:16.430 align:middle line:84%
the correct trunk, which is 2/2.

124
04:16.430 --> 04:17.600 align:middle line:84%
Fantastic.

125
04:17.600 --> 04:21.880 align:middle line:90%
And we'll go into configuration
mode and in interface gig 2/2,

126
04:21.880 --> 04:24.300 align:middle line:90%
and switchport port
security space.

127
04:24.300 --> 04:28.721 align:middle line:90%
We'll specify the maximum number
of MAC addresses of 2,000.

128
04:28.721 --> 04:31.020 align:middle line:90%
It didn't like that
period at the end.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

128
04:28.721 --> 04:31.020 align:middle line:90%
It didn't like that
period at the end.

129
04:31.020 --> 04:33.680 align:middle line:90%
And we'll specify
the violation action.

130
04:33.680 --> 04:36.350 align:middle line:90%
So switchport port
security violation

131
04:36.350 --> 04:39.050 align:middle line:90%
is going to be the
action of protect.

132
04:39.050 --> 04:39.600 align:middle line:84%
Great.

133
04:39.600 --> 04:40.975 align:middle line:90%
And then we'll
enable the feature

134
04:40.975 --> 04:43.880 align:middle line:90%
just by using the command
switchport port security,

135
04:43.880 --> 04:45.150 align:middle line:84%
and pressing Enter.

136
04:45.150 --> 04:46.370 align:middle line:84%
Then we'll verify our work.

137
04:46.370 --> 04:48.930 align:middle line:84%
Show port security.

138
04:48.930 --> 04:49.430 align:middle line:84%
Great.

139
04:49.430 --> 04:51.087 align:middle line:84%
Gig 2/2, 2,000.

140
04:51.087 --> 04:53.420 align:middle line:90%
Wow, it has four MAC addresses
at the moment in the lab.

141
04:53.420 --> 04:53.920 align:middle line:84%
Great.

142
04:53.920 --> 04:55.370 align:middle line:84%
The security action is protect.

143
04:55.370 --> 04:57.120 align:middle line:90%
And let's also do that
same command again,

144
04:57.120 --> 04:59.990 align:middle line:84%
but we'll say interface gig 2/2.

145
04:59.990 --> 05:01.400 align:middle line:84%
Press Enter.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

145
04:59.990 --> 05:01.400 align:middle line:84%
Press Enter.

146
05:01.400 --> 05:04.400 align:middle line:90%
And the number of MAC addresses
is growing as it's dynamically

147
05:04.400 --> 05:05.750 align:middle line:84%
seeing more and more.

148
05:05.750 --> 05:08.630 align:middle line:90%
So in this lab and video
we've applied our skills

149
05:08.630 --> 05:12.110 align:middle line:90%
of using port security to
the trunk ports on core 1

150
05:12.110 --> 05:13.580 align:middle line:90%
and core 2 for
their connectivity

151
05:13.580 --> 05:15.330 align:middle line:84%
up to the access layer switch.

152
05:15.330 --> 05:18.270 align:middle line:90%
And if you have done this lab
with me, which I hope you have,

153
05:18.270 --> 05:21.140 align:middle line:90%
whether it's in our gear, or
virtual lab somewhere else,

154
05:21.140 --> 05:24.050 align:middle line:90%
or physical hardware, or
GNS3, or Packet Tracer,

155
05:24.050 --> 05:28.070 align:middle line:90%
if you've done this exercise,
give yourself another 10 points

156
05:28.070 --> 05:29.810 align:middle line:84%
on our journey towards 100.

157
05:29.810 --> 05:32.060 align:middle line:90%
And that gamifies or
makes it a little more fun
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

157
05:29.810 --> 05:32.060 align:middle line:90%
And that gamifies or
makes it a little more fun

158
05:32.060 --> 05:34.190 align:middle line:90%
as we build our
skills that we can put

159
05:34.190 --> 05:35.900 align:middle line:84%
to use in production networks.

160
05:35.900 --> 05:39.930 align:middle line:90%
And that makes us, you and I,
more valuable to our families,

161
05:39.930 --> 05:41.780 align:middle line:90%
to our friends, and
to our employers.

162
05:41.780 --> 05:43.670 align:middle line:90%
So I've enjoyed having
you on this journey

163
05:43.670 --> 05:45.560 align:middle line:84%
in this skill of port security.

164
05:45.560 --> 05:47.730 align:middle line:90%
And I'll see you in
the very next video.

165
05:47.730 --> 05:50.240 align:middle line:90%
Meanwhile, I hope this has
been informative for you.

166
05:50.240 --> 05:53.590 align:middle line:90%
And I'd like to thank
you for viewing.