All language subtitles for Free-CCNA-Port-Security-Day-49-CCNA-200-301-Complete-Course_en

This is a free, complete course for the CCNA.

If you like these videos, please subscribe\n

Also, please like and leave a comment, and\n

In this video we will talk about port security.

Port security is a security feature on Cisco\n

MAC addresses are allowed on a switch port,\n

It’s covered in exam topic 5.7, which says\n

features, including DHCP snooping, ARP inspection,\n

Those other two, DHCP snooping and ARP inspection,\n

But for this video, we’ll focus on port\nsecurity.

Here’s what we’ll cover in this video.

First, I’ll introduce what port security\nis.

But knowing what it is isn’t enough.

I’ll also explain why we use port security,\n

And I’ll show you various port security\n

As always, watch until the end of the video\n

ExSim for CCNA, my recommended practice exams\nfor the CCNA.

First up, what is port security?

Well, it’s a security feature of Cisco switches.

It allows you to control which source MAC\n

So, it’s configured on a per-interface basis.

By the way, throughout this video I’ll probably\n

So, if a frame with an unauthorized source\n

There are a few possible actions that you\n

place the interface in an err-disabled state.

In effect, this is like shutting down the\ninterface.

Traffic will no longer be sent or received\nby that interface.

PC1 is connected to SW1’s G0/1 interface.

As you know, MAC addresses are actually 12\n

them here to make it easier to read.

The user of PC1 brought in his personal laptop\n

The network admin has configured port security\n

allow frames with a source MAC address of\n

When PC1 sends a frame, SW1 will check the\n

so it will forward it to the destination as\nnormal.

But the user unplugs the cable from PC1 and\n

What will happen when PC2 sends a frame?

Well, SW1 will check the source MAC address\n

So, SW1 will place G0/1 in an err-disabled\nstate.

It won’t send or receive data until you\n

Now, as I said there are a few possible actions\n

later, but for now let’s assume the default\naction of shutdown.

So, noticing that his laptop isn’t able\n

unplugs the cable from his laptop and connects\nit back to PC1.

What happens when PC1 sends a frame?

Well, the interface is still err-disabled,\n

There are two ways to enable an interface\n

Okay let’s cover a few more points about\nport security.

When you enable port security on an interface\n

You can configure the allowed MAC address\nmanually if you want.

But if you don’t configure it manually,\n

address that enters the interface.

That MAC address will be allowed on the interface,\n

However, you can change the maximum number\n

Here’s one situation in which you should\n

Phone1 is directly connected to SW1, and PC1\n

The default port security setting, which allows\n

this situation, because both PC1 and phone1\n

MAC address as the source, so that’s two\nMAC addresses.

So, in this case let’s say we configured\n

But we didn’t configure them manually, we\n

So, if phone1 sends a frame SW1 will add it\n

Then if PC1 sends a frame, SW1 will also add\n

But now SW1’s G0/1 interface has reached\n

If the interface is connected to another device\n

interface because the source MAC address isn’t\nauthorized.

Okay, in this introduced two main points.

First, the default number of allowed MAC addresses\n

you can configure it to allow more.

Second, the allowed MAC addresses can be manually\n

In this example, both were dynamically learned,\n

SW1 to allow C.C.C on G0/1, and then allow\n

So, if more than one MAC address is allowed,\n

or all have to be dynamically learned, a combination\n

You can probably imagine how port security\n

It’s useful because it allows network admins\n

Someone can’t just plug an unauthorized\n

However, MAC address spoofing is a simple\ntask.

It’s easy to configure a device to send\n

So, be aware that port security isn’t a\n

But, rather than manually specifying the MAC\n

ability to limit the number of MAC addresses\n

For example, think back to the DHCP starvation\n

The attacker spoofed thousands of fake MAC\n

addresses to those fake MAC addresses, exhausting\nthe DHCP pool.

But not just that, switches can’t learn\n

switch’s MAC address table can also become\n

Then the switch can no longer learn new MAC\n

Using port security to limit the number of\n

Both aspects of port security are useful:\n

and controlling how many MAC addresses are\n

Now, before going deeper into other areas\n

Port security is enabled directly on the interface,\n

G0/1 and try the command SWITCHPORT PORT-SECURITY.

However, it’s rejected with a message saying\n

To check I used SHOW INTERFACES G0/1 SWITCHPORT.\n

By default, switchports have an administrative\n

SWITCHPORT MODE DYNAMIC AUTO, I covered that\n

Port security can be enabled on access ports\n

configured as access or trunk.

Dynamic auto and dynamic desirable are not\nallowed.

So, I used SWITCHPORT MODE ACCESS to configure\n

Then I used SHOW INTERFACES G0/1 SWITCHPORT\n

is now static access, so the SWITCHPORT PORT-SECURITY\n

And indeed it does, so port security is now\nenabled on G0/1.

When you use just this command, port security\n

Let’s check out those default settings.

The command SHOW PORT-SECURITY INTERFACE,\n

First, port security is enabled, and the port\n

Secure-up just means port security is enabled,\n

The default violation mode is shutdown, as\nI said before.

If an unauthorized frame enters the interface,\n

Here are some default settings regarding the\ntimers.

The aging time of 0 minutes means that the\n

Here we can see information about the MAC\naddresses.

The maximum is 1, currently it knows 0, 0\n

0 sticky MAC addresses, that’s also something\n

SW1 hasn’t received any traffic on this\n

is all 0s, with VLAN number 0.

Finally, there have been no violations so\n

Now I sent a ping from PC1 to R1, let’s\n

I’ve highlighted the two places that have\nchanged.

Total MAC addresses has changed from 0 to\n

Note that the maximum is also 1, so SW1 won’t\n

Also, the last source address has changed\n

Now let’s bring back PC2, and connect the\ncable to it instead.

What will happen when PC2 tries to ping R1?

From the top of the output, the port status\n

By the way, if you check SHOW INTERFACES STATUS,\n

But in the SHOW PORT-SECURITY INTERFACE command,\n

Also, the total MAC addresses count has reset\nto 0.

So, it dynamically learned PC1’s MAC address\n

The last source address is PC2’s MAC address,\nB.B.B.

And the security violation count is now 1.

Okay, so let’s see how to re-enable an interface\n

Okay, here’s how to manually re-enable the\ninterface.

But before entering any commands, you should\n

After disconnecting the unauthorized device,\n

SHUTDOWN, which puts it in administratively\n

Let’s check out SHOW PORT-SECURITY INTERFACE.

The port status is back to secure-up.

The last source address, which was PC2’s\n

And at the bottom, the security violation\n

So, with the default violation mode, shutdown,\n

Now, there’s another way to re-enable an\n

It causes err-disabled interfaces to be automatically\n

There are actually various reasons an interface\n

I used the command SHOW ERRDISABLE RECOVERY,\n

There are so many that I had to omit a lot\n

On the left is each err-disable reason, and\n

By default, it is disabled for all reasons,\n

The one we’re looking for is psecure-violation,\n

Notice the default timer is 300 seconds.

So, every 5 minutes by default, all err-disabled\n

recovery has been enabled for the cause of\n

So, let’s enable it for port security violations.

The command is ERRDISABLE RECOVERY CAUSE,\n

And just to demonstrate the command, I shortened\n

and then specified 180 seconds.

Here’s SHOW ERRDISABLE RECOVERY again.

Notice that the psecure-violation recovery\n

is 180 seconds, as configured.

And just to demonstrate I caused G0/1 to become\n

will be enabled at the next timeout, and there\n

So, this is a useful feature, but it’s useless\n

the interface to enter the err-disabled state.

So, that will always be step 1.

Disconnect the unauthorized device, and then\n

let errdisable recovery do it for you automatically.

What will happen if you don’t disconnect\n

Well, if you manually configured the secure\n

disabled again when it receives another frame\n

But if you let the switch dynamically learn\n

when the interface is disabled.

When the interface is re-enabled, the unauthorized\n

secure MAC address on the interface, which\n

So, remember to disconnect the unauthorized\ndevice.

Okay, now let’s talk about those violation\nmodes.

I just showed you the default mode, shutdown,\n

But there are three different violation modes\n

an unauthorized frame enters an interface\n

The first is the default, shutdown.

It effectively shuts down the port by placing\n

It will also generate a Syslog and/or SNMP\n

However, after the interface is down it won’t\n

device continues trying to send traffic.

Only one message is generated to say that\nthe port was disabled.

The violation counter is set to 1 when the\n

reset to 0 when the interface is re-enabled,\nas you saw before.

Okay, the next violation mode is restrict.

The switch will discard traffic from unauthorized\nMAC addresses.

However, the interface is not disabled.

Devices with authorized MAC addresses will\n

The switch generates a syslog and/or SNMP\n

And the violation counter is incremented by\n

Okay, that’s restrict mode, now the last\none.

Like restrict mode, the switch discards traffic\n

However, it does not generate syslog or SNMP\n

And it doesn’t increment the violation counter\neither.

It just silently discards unauthorized traffic.

Okay, so we already saw the shutdown mode,\n

Here’s the restrict violation mode.

I’m starting from a fresh port-security\n

This time, I manually authorized PC1’s MAC\n

followed by PC1’s MAC address.

And here’s how to enable restrict mode.

SWITCHPORT PORT-SECURITY VIOLATION RESTRICT.

Then I tried to ping R1 from PC2, and I got\n

tells us that a security violation occurred,\n

Let’s check SHOW PORT-SECURITY INTERFACE.

First, notice the violation mode of restrict.

And you can see that the violation count has\n

However, the port status is secure-up, not\nsecure-shutdown.

So, if I were to connect the cable back to\n

no problem, because the interface is still\n

Okay, that’s the restrict violation mode.

And here’s the last one, protect.

We’re starting with a fresh configuration\n

I once again manually authorized PC1’s MAC\naddress.

And then I configured SWITCHPORT PORT-SECURITY\n

And then sent some traffic from PC2.

PC2’s pings failed, but there were no syslog\nmessages on SW1.

Let’s check this command again.

The port status is secure-up, the violation\n

So, SW1 discarded the traffic from PC2, but\n

That’s the protect violation mode.

OK, here’s that summary of the violation\nmodes again.

These are how you control what the switch\n

You should definitely learn the actions taken\n

Okay, moving down to the next part of the\n

check out secure MAC address aging.

By the way, MAC addresses dynamically learned\n

enabled port are called secure MAC addresses.

By default, secure MAC addresses will not\nage out.

There is no timer, they are permanent unless\n

or the port is disabled and then re-enabled.

That’s what the aging time of 0 minutes\nmeans.

However, you can configure this timer with\n

TIME, and then the time in minutes.

If you do configure an aging time, the default\n

Let me explain what that means.

Absolute aging means that, after the secure\n

and the MAC address is removed after the timer\n

frames from that source MAC address while\nit is counting down.

However, after the MAC address ages out it\n

frame with that source MAC is received.

The other aging type is inactivity.

This is like regular MAC address aging.

After the MAC address is learned the aging\n

frame from that source MAC address is received.

So, if the switch keeps receiving frames from\n

You can configure the aging type with SWITCHPORT\n

Now, by default only dynamically-learned secure\n

If you configure a MAC with SWITCHPORT PORT-SECURITY\n

The command will remain in the running-config\n

But with the command SWITCHPORT PORT-SECURITY\n

out static secure MAC addresses, too.

The command will be removed from the running\n

the MAC address table if it ages out.

Let me show you those commands in the CLI.

I configured an aging time of 30 minutes,\n

of static secure MAC addresses.

Then I checked SHOW PORT-SECURITY INTERFACE\n

Aging time 30 minutes, aging type inactivity,\n

Okay, that’s all you really need to know\nabout the timers.

But before moving on to the next topic, let\n

It displays which interfaces have port security\n

addresses on those interfaces, their security\n

In this case, I only have port security enabled\n

many this is a useful command to get an overview\n

Next, here’s the last major topic of the\n

Sticky secure MAC address learning can be\n

SWITCHPORT PORT-SECURITY MAC-ADDRESS STICKY.

When enabled, dynamically-learned secure MAC\n

So, if you look in the running config you’ll\n

SWITCHPORT PORT-SECURITY MAC-ADDRESS STICKY,\n

These sticky secure MAC addresses will never\n

However, because they are added to the running-config,\n

the running-config to the startup-config to\n

If you don’t do that, they will be lost\n

When you issue the SWITCHPORT PORT-SECURITY\n

secure MAC addresses will be converted to\n

So, they will be added to the running config.

If you remove sticky learning, sticky secure\n

Okay, let’s check it out in the CLI.

So, as always I enabled port-security first.

Then I issued SWITCHPORT PORT-SECURITY MAC-ADDRESS\n

I then checked the G0/1 interface in the running-config,\n

SWITCHPORT PORT-SECURITY MAC-ADDRESS STICKY,\n

I didn’t configure that command, it was\n

So, sticky MAC addresses are basically a way\n

without actually having to manually configure\nthem

Okay, before moving on to review and the quiz,\n

Secure MAC addresses will be added to the\n

Sticky and static secure MAC addresses will\n

secure MAC addresses that aren’t sticky\n

And you can view all secure MAC addresses\n

I used the command, and here is PC1’s MAC\n

Notice the type of static, even though I didn’t\n

Here’s a summary of the commands we covered\nin this video.

You’ll definitely want to experiment with\n

Follow my packet tracer lab, and also try\nmaking your own.

If you don’t remember any of these commands,\n

Before moving on to the quiz, let’s review\nwhat we learned.

First I gave an intro to port security, and\n

Basically, it allows you to control what source\n

are allowed to enter a switch interface.

I also briefly explained why we should use\nport security.

First of all, it allows us to prevent unauthorized\n

And secondly, it helps defend against attacks\n

in a previous video, in which thousands of\n

Then, while explaining various aspects of\n

Make sure to watch until the end of the quiz\n

ExSim, my recommended practice exams for the\nCCNA.

Okay, let’s go to quiz question 1.

Examine the show command output below.

How many secure MAC addresses were dynamically\n

Pause the video now to examine the output\n

So, according to the output 4 total MAC addresses\n

1 was configured, that’s not dynamic.

There are 3 sticky MAC addresses, what about\nthem?

Although sticky MAC addresses are inserted\n

address, and their type in the MAC address\n

So those 3 sticky MAC addresses were dynamically\n

Which of the following occur when a port-security\n

(select the two best answers) Okay, pause\n

Okay, the best answers are B, unauthorized\n

In addition, a syslog message and SNMP trap\nwill be sent.

However, an SNMP Get message, as in D, will\nnot be sent.

GET messages are sent from the SNMP manager\n

What will SW1 do when an unauthorized frame\narrives on G0/1?

Pause the video now to examine the output\n

Okay, the best answer is A, unauthorized traffic\n

The violation mode is protect, which means\n

However, the interface won’t be err-disabled.

Authorized frames will still be forwarded.

No syslog or SNMP messages will be sent, and\n

Which of the following will re-enable an interface\n

Okay, pause the video now to select the two\nbest answers.

The best answers are A, SHUTDOWN and NO SHUTDOWN\n

CAUSE PSECURE-VIOLATION in global config mode.

Either of these will work to re-enable the\ninterface.

C, unplugging the unauthorized device, is\n

Note that, you should unplug the unauthorized\n

the device itself won’t re-enable the interface.

What will happen when the switchport port-security\n

Pause the video now to examine the output\n

Okay, the answer is a, the command will be\naccepted.

The administrative mode of G0/1 is static\n

However, if it was the default administrative\n

Port security can be configured on access\n

configured with SWITCHPORT MODE ACCESS or\nSWITCHPORT MODE TRUNK.

Okay, that’s all for the quiz.

Now let’s take a look at a bonus question\n

There are supplementary materials for this\nvideo.

There is a flashcard deck to use with the\nsoftware ‘Anki’.

There will also be a packet tracer practice\n

That will be in the next video.

Before finishing today’s video I want to\n

To join, please click the ‘Join’ button\nunder the video.

Thank you to Samil, C Mohd, Scott, Martin,\n

Serge, Njoku, Viktor, Roger, Suki, Kenneth,\n

Prakaash, Nasir, Erlison, Marko, Daming, Ed,\n

Software, Devin, Yonatan, and Vance.

Sorry if I pronounced your name incorrectly,\n

This is the list of JCNP-level members at\n

If you signed up recently and your name isn’t\n

Please subscribe to the channel, like the\n

with anyone else studying for the CCNA.

If you want to leave a tip, check the links\nin the description.

I'm also a Brave verified publisher and accept\n