Time
13 hours 57 minutes
Difficulty
Beginner
CEU/CPE
14

Video Transcription

00:00
Hello and welcome back to I, C and D one interconnecting Cisco Networking devices. Part one,
00:05
this is episode 234 Trend Darrow. Very structure for this course.
00:11
Unless video one over configuring speed and duplex options, I'm switching our faces along with the other negotiation. This episode will be covered in port security, the different options with it and the security moves
00:25
and the learning objectives burn over the violation modes. We're gonna show you how to configure it, and then we're gonna verify it.
00:32
And a quick pre assessment. Hopefully remember this from the lesson introduction. Which port security violation mode will shut down the port into an air disabled states
00:41
also, remember, I'll give you a few seconds.
00:47
All right? It is the shutdown violation mode
00:50
and quick lab notes. Rumor I swept up Mike Ality or my voodoo server with the Cali Lennox of'em.
00:56
I'm actually just removed the windows Hot 10 host in the Browder for the SoHo Broader from this because it's kind of relevant. So then I still laptop there with the veal and one set, so make sure that all these I pee their set
01:10
and we'll go in. I'm just going to verify We have that. We can ping everything quick.
01:17
Someone's gonna bring up putty.
01:19
All right, let's do a king to 10. 12 50
01:26
were success, and we got 51
01:30
and we're success.
01:30
All right.
01:33
Now you probably want to verify on both ends as well. You want to
01:37
start from the laptop to the
01:40
to switch and then paying to the V M and back and forth started closest, then go farthest. Just minimize issues,
01:48
you know, jump right into port security. So what, it does it secure that switch interface based on the Mac address it receives on that port? Right?
01:55
So there's a couple of deacon statically configure or dynamically, or you sticky
02:00
configure the Mac address in the running config and the Do this under the interface configuration mode,
02:07
Um, we will go into an imminent the default violation mode, for this is going to be shut down. It's three different kinds. There's protect restrict a shutdown.
02:15
So the difference is is
02:20
all of them are going to discard offending traffic. If
02:23
port security has triggered,
02:25
um, restrict and shut down is going to log it and send it S and M p message, if that's set up, restricted shutdown are both going to increments. That violation counter,
02:36
but shut down is the only one is actually going to disable that port.
02:42
So we're going to a lab and show you what this actually means here in a minute.
02:46
All right, so here's the commands that you kind of wanna gotta have to No, um, I realized this a lot. We will go through all the use together here in the lab
02:54
if you want to just get these written down or quick, and we'll go through them all. So don't worry.
03:00
I'm gonna go ahead and bring up
03:02
party real quick,
03:04
and I'll just do a show Mac address table.
03:08
Actually, it's just do dynamic so we can avoid all that.
03:14
So you have.
03:16
All right. So I'm not sure why this one showed up, because these two are going to be both my
03:23
actual ones. Ministers of the M thing.
03:28
I don't know. I'm not gonna play that anyway, so we have just three right now, So why would we use
03:34
poor security? Um,
03:37
one thing that can happen is this. What's called camp table over, Folks. Remember the Mac address table stored in camp table.
03:45
So we go where I can't table overflow here, so I'm gonna show you the what it does is eventually the Mech address table completely fills up and
03:53
switch. Just kind of throws his arms up and says I'm done
03:55
and everything. All the
03:59
frames just get sent out. A report just just gets flooded everywhere.
04:03
So, one this is gonna this could be accused for a dedicated denial of service or just denial of service attack.
04:11
Um, it can also be used for sniffing. Right. So people that are sniffing packets on the network trying to get credentials or
04:17
trying to get credit card something like that that could be used for that Mean while everyone else is just gonna sit here and think, Why is the network running slow?
04:27
Um, meanwhile, he's captured all the packets that you're sending.
04:30
So I'm gonna go ahead and just bring up my Callie the Amro, quick, and I'll just show you the commander. Run.
04:38
Please do not run this unless it's in your own lab network. This is unless you have authorisation by the company.
04:46
So do you want a side of Keats Zero
04:48
and We'll just send 100 at a time with the Senate 1000 real quick.
04:54
All right, so now don't ring up party again
04:58
and we'll do a North Show that could dress table.
05:00
Yeah, and this is gonna go on for a while. So we can do is show Mack dressed table count.
05:09
So now it's so caught 433 of them.
05:12
So I'm gonna bring up Kelly again.
05:16
It will just go into that, because
05:19
that's its not gonna reach that.
05:21
So we'll just let that run. I'm gonna bring up, buddy,
05:26
and we'll just go through and we're pretty way up, man. We're full up
05:31
area. They're full up. 48 sport reserved. Um,
05:36
so at this point, anything would be sent out everything. And it's just being broadcasted. Basically,
05:43
I'm gonna go ahead and stop it real quick. Just control. See,
05:47
because I don't wantto kill my connection away.
05:50
We're gonna do is just clear. Mac address table.
05:56
I name it.
05:59
Anyway, that's that's how easy it is. Um, if you don't have port security enabled, there's still weighs on port security, if you know,
06:06
very useful and easy to configure thing.
06:10
So go and jump into it here.
06:12
Figured t going to interface first. Even zero
06:16
six for the
06:18
gateway. Want to laptop?
06:20
And we'll do switch ports, ports, security.
06:28
Just enter first.
06:30
Oh, sir, Sports mode.
06:33
So you have to. So if we're going to hear, you have to set your switch Port
06:39
as either trunk or access it can't be said is dynamic has to be one of the two. Access or trunk.
06:46
Um,
06:47
remember that
06:48
it's gonna be important. Switch port Port security. This will actually enable port security.
06:55
And let's go switch port. Port security will go to maximum of one Mac address.
07:03
All right, all right. So much. You're gonna set this one to the violation mode.
07:10
Restrict. So it's not gonna actually shut down that interface. It's just gonna keep walking
07:15
violation counters and, you know,
07:17
blogging actual ares.
07:26
All right,
07:28
So I will do They do show, run face. That makes six.
07:34
All right, So you have to shut the address down where have the device on plug before you can enter that port Security Mac address.
07:44
So I'm gonna do a no. Shuts was enable its Onda show port security interface phase. They're six, and we'll see the last source we are and restrict our secure up
07:59
violation Counter zero. Somebody go out and plug in my surface, leapt up, and we'll see that violation counter Go up.
08:09
All right. So I just went ahead and sent a constant ping through this one.
08:16
All right, so now we're seeing in port security violations
08:20
messages here. Like I said, there is a message. And if we go and we should see the violation counter it happening because I have a constant ping going through right now. It's just spamming it. So it'll just keep seeing it go up someone go ahead and cancel it out right now. And I'm gonna plug in the old device.
08:35
All right, so now we're back here on DU Port Security.
08:41
All right, so now we are so last sources on the old one.
08:46
So I'm gonna send out a ping through the booty laptop that is now plug back in.
08:52
All right, so now that the gateway or the you boon to laptop's plugged back in it can paying. It works. Fine. My pings on my surface, lad. Top that.
09:01
You know, I was setting the violation counts up that one couldn't ping because it was discarding that offending traffic. Right.
09:07
So let me show you the difference with this and the shutdown mode. So the interface FAA 06
09:13
Sore sport court security violation. Shut down.
09:20
So now let's do a show. Port security interface F A 06
09:28
So now we are unable Risk Europe. Shut down! We have one configured Mac address.
09:33
I'm gonna go ahead and plug in there. I'm gonna make sure that we can ping on the gateway real quick.
09:39
All right, so the gateway still pinging. I'm gonna go ahead and unplug the gateway. Heard the boon to leapt up and plug in the surface. Lad. Top row quick.
09:46
All right. So should see the port security violation coming in soon.
09:56
Alright, here we go.
09:56
As we're waiting for port security violation were Aargh disabled state.
10:03
You're on this. We're in secure Shut down.
10:05
And if you look into the show I clean interface brief,
10:11
you will see it is down as well. If you run a show and status,
10:16
you will see the error disabled state
10:22
to know these different show commands. They're gonna help you out in the exam a lot. It's gonna be a huge thing is knowing what show commands to use. So remember him.
10:31
So now you've seen what you know, where strict does when it discards a traffic. So the only thing with restrict and protect is remember that
10:41
protects, will, you won't see the log messages. You won't see the violation counter
10:46
essentially the port you just can't use on the offending device.
10:50
Um, the restrict will actually log that message and set the violation counter and let you know that there's something happening but assumed you plug in the original device, it starts working again.
11:00
But now that we're in an air disabled state from the defending device and the state
11:07
from the shutdown mode, I'm gonna go ahead and plug in my gateway or the Abou to laptop again, and we'll see what happens.
11:16
All right, so I'm getting a network unreachable. Um,
11:20
um, my gateway to Europe into that tub right now,
11:24
So if we do this again, we're still air disabled. So why isn't working?
11:28
So when it gets into the air to see, it will stay. And you're confident that you have the correct device plugged on, Just going to interface FAA 06
11:35
So we're going to interface configuration will shut it down and put it into administratively. Shut down mode.
11:41
I think you'll see Here
11:43
it is disabled. Now it's administratively. Shut down.
11:46
So, like we see interface, run this one,
11:50
uh, to show your face of phase or a six.
11:54
This one gives a lot more information. Right? So you can see that is actually administrative it shut down.
12:00
How to do plaques on the speed
12:03
play around all these different show commands that just learned him. See what you can learn from See what gives you what information What once you know,
12:11
shows you what?
12:13
So now that we're into an administrative shut down, the little is doing no shuts to bring the port back up.
12:18
I'm gonna start the ping on the late Gateway
12:24
Show I P interface brief.
12:31
All right, so now we're up. Up.
12:33
We're on a show port security interface of phaser six. Again.
12:39
We'll see. Secure up.
12:41
Right. And the pink commands air going through on the gateway laptop now.
12:46
All right, I apologize. Videos probably getting snipped in here. And they're, um
12:50
But one thing I realized I forgot to do was show you guys the Mac address sticky
12:56
and the Mac address and learning. So we did. We did a static Mac address. So I'm gonna go ahead and do the Mac address Sticky. So the switch ports,
13:05
Port security, Mac address
13:07
sticky.
13:09
So this is nice, because, um,
13:11
let's say you're rewiring an entire closet. You can just set them all the sticky. And let's say you, you know, for a fact that every device that's gonna be plugged in is your device and that a malicious device
13:22
instead of having to type in every single Mac address, which will just be tiresome,
13:26
we can use sticky, and it'll automatically pull it in. So if we do a show Ron interface, FAA.
13:33
You're six.
13:35
All right. I'm gonna go ahead and send some pink commands from the a boon to laptop pulled it in its ah, much more convenient.
13:45
All right, so I'm gonna go ahead and get the party session out here.
13:48
All right? Finally answer the post assessments. What must you designate to switch port? As which the two following to configure port security.
13:56
So remember, you must you have to designate it as to one of two things in order. Configure port security for the interface. So give me a few seconds toe. Figure it out.
14:09
All right. Remember, it is your trunk port or access ports. You can't have it set on
14:16
the auto mode.
14:18
Right in the next module. We're gonna go over Eastern that lands the design of the lions and troubleshooting. I couldn't find any good broadcast and collision domain pictures that looked interesting.
14:31
So I just tried to find a mean. Hopefully, you guys enjoyed it.
14:37
And as always, if you guys have questions, you need some help. Feel free to shoot me. Message. Otherwise, thank you for watching this video.
14:43
You know, before you see the next one.

Up Next

CCNA ICND1

This course will enable students to understand virtualization and cloud services, and network programmability related to LAN, access and core segments.

Instructed By

Instructor Profile Image
Trenton Darrow
Network Engineer at NCI Information Systems, Inc
Instructor