Original subtitles

>> Imagine with me for a moment that you're making a recipe, and you're, you know, getting--

assembling all the ingredients together for this brand new recipe that you're creating,

and you know, five of cups of sugar, two [laughs]--

actually that's a lot of sugar, two cups of flour, you know.

And then at the very bottom of the recipe it says contents of the black bag,

and you go "Well, that's interesting."

And then in parentheses that's where it says, "Ask your grocer."

So, you go to the grocery store and you're like, "Hey, I've got this recipe asking

for the black bag, and they go, "Oh, we know what that is."

And, they go to the back and they pull out this black bag, no labels or anything like that,

all there is, is a $2.53 price tag.

And you go, "Okay, what's in here?"

And the grocer's like "I don't know.

Honestly a lot of people ask for this, it's some recipe out there that needs a black bag."

So, you get home and you open up the black bag and inside is this orange greenish powder

and you're like, "Aah" okay, so let me ask you right there,

would you feel comfortable pouring the contents of that black bag

into your recipe not only comfortable with the five cups of sugar but also that black--

you know, the orange-greenish powder and kind of mixing up

and making whatever it is that this recipe is?

No, you wouldn't feel comfortable with that.

You're going to be like, "I want to know what's in that black bag.

I mean for all you know it could be pesticide, it could be strychnine poison immediate--

I mean it could something really good.

I mean, the point is you don't know, and that's the whole point of Port Security.

One of the keys to a solid network is knowing what kind of stuff is attaching to it.

There's this whole new [inaudible] nowadays and actually if you Google it, B-Y-O-D,

Bring Your Own Device networks, which is this is a big debate right now going

on in the network community of like, now that we have all of these kinds of devices, Ipads,

Smartphones, everybody's got their own laptop.

I want to use a McIntosh but my corporation only supports Windows.

I want to bring my own device.

And, we're in this world now towards like a B-Y-O-D device world where people expect

that I can just bring whatever I want and I plug it in my network.

From your perspective it's black bags.

It's people that are bringing-- I mean, inside this is orange-green powder, is that bad?

I hope not.

But what if somebody brings their own little black bag that is Strychnine.

It's got a virus, it's got a Trojan, it's-- I mean, I would say at least it's infected

with something that's running peer-to peer file sharing and it's gobbling up all your bandwidth.

In my opinion, Bring Your Own Device is a bad idea.

But, corporations are now expecting it, you know,

management is now approving it not realizing exactly what they're improving.

So, you're starting to see a lot of security methods out that there

that help you manage this B-Y-O-D, this kind of management of the unmanaged world that exist,

so that's what this nugget is all about, is port security.

How do you manage-- at least to some level, what kind of devices

or what devices are attaching to your network?

That's what Port Security is all about.

So, we've already stepped a little bit into this slide by answering the question,

why we care what plugs into our network?

We care because there's just messed up stuff out there.

I mean, there's-- it's common for laptops to come in and be infected.

And a matter of fact, one of the businesses

that I operate is a business called school desk [phonetic] and its goal is

to do a complete IT management system for schools.

Well, one of the schools that we manage had a B-Y-O-D Day, essentially for the students.

They said, "Okay, well, this week is"-- I think it was like midterms or finals or something.

So, we want all of our students-- they didn't tell me this but they said,

"We want all of our students to bring in their laptops, their Ipads

or whatever device they feel comfortable working on from home so that they can work

from the classroom or from the school on their own device.

Well, come Monday morning "bam" internet connection is just solid pegged,

the school is calling me, going, "Hey, our internet connection is down, what's the deal?"

And I said, "I don't know, let me look."

And, I'm starting-- I'm like.

"Hey, there's-- I'm seeing all kinds of devices that are going up and just trying to gobble

up every single bit of bandwidth that's available, what's going--

and they go, "Oh, this is a Bring Your Device to School Day."

And I'm like, "What?"

You know, I'm like, "What?

Who authorized this?"

And so, they-- well, can you find out who is using all the bandwidth and block them?

And I go, "I can try."

So, sure enough you can-- in Cisco Firewalls, you can actually identify top users.

And, here's the funny thing, think of it this way, I had a school that I managed

to use their internet connection which is only 3 megabits per second, they got bonded T1 lines

which feeds this whole school and they've got all of these new laptops.

So, literally here is me sitting on the-- no, not literally sitting on the Firewall,

but logged into the Firewall and I see-- okay, this guy is eating all the bandwidth

so I'm like, "Okay, block that guy."

A soon as I blocked him, another guy starts eating all the bandwidth.

I'm like, "Oh, block him."

And finally I called him, I said, "I can't" I said every single--

it's like, you know, one of those like crazy sci-fi movies where, you know,

you've got a guy with a sword sitting there, and all these little lemmings are

like [inaudible] they're running like trying to beat them all--

this is kind of a weird scenario, but that's what I felt like.

I'm like, "I can't get them all."

I'm like they're all just running at me.

I'm swinging like mad and I can't knock them all down.

And, the reason why?

We brought in a whole-- we brought in hundreds of student laptops.

What do students do in their spare time?

Steal stuff.

[laughs] I'm being serious.

They're on peer-to-peer networks downloading illegal software, music, games,

and when they do that they infect-- unknowingly they infect their device

with all kinds of stuff.

I mean, the kind of-- anyway, you get my point.

Why do we care what plugs into my network?

I think I've made the case.

Because people bring in things that disrupt the normal operation of every single day business

at your organization, so that's-- again, that's why I go back

to that Bring Your Own Device model, is just-- it's crazy.

There's ways that you can manage it but it just gets ugly.

So, Port Security, the topic-- I feel like I'm saw [phonetic] box, I'm getting done.

Port Security allows you to restrict connection to the LAN in two ways.

One, by limiting the number of MAC addresses per port.

Two, by choosing what MAC address is allowed on a port.

So, for example, one of the things that we don't want is somebody

in their cubicle office whatever plugging in for example a wireless access point

that we don't know about, that is now broadcasting our network out into the world

and all these strange devices start connecting and getting into our internal network and,

you know, that's not good for security at all.

So, what I can do is I can say, "Well, I'm only going to allow one MAC address on that port.

If there's any more than one MAC address that shows up there, like somebody plugged in this

and all these devices are starting to come in, disable the port, you know, block the port,

don't allow it to happen, or you know, somebody tries to build their own little network,

they plug in a little hub or switch from home that, you know, people--

well, they mean to be harmless can sometimes do a lot of damage.

I mean, what is that device that they just plugged in?

They think it's a hub or a switch but maybe it's one of those, you know,

D-link all in one router switch devices that are out there.

And, the problem with that is they just brought in a rogue DHCP server,

not even knowing that that's what they brought in so it's handing bad IP addresses to the rest

of my network, and all my clients are starting to get those IP addresses and fall off

because it's on a different subnet [phonetic] it's on a different--

it's totally different network than my own, that would be another example.

So, doing-- setting a-- this is-- I would say a no-brainer.

Almost every company should limit how many devices are allowed per port.

This one is a little more high maintenance.

For instance I talked to somebody that worked at the Phoenix Police Department here in Arizona

and they used this to where-- literally they say, "This PC is plugged into that port,

its MAC address is 0011.bb, you know, 11.111, something like that,

to where if somebody disconnects that computer and plugs in any other kind of device

that has a different MAC address, and they all will, it will immediately shut down that port.

A little higher maintenance because, you know, for instance moving people around,

connecting devices on a whim goes away.

But, for high level security that's something that you can do.

Our ports can react and shut down, protect or restrict modes.

Shutdown does exactly what it says it does.

As soon as you violate the policy, be at the number of MAC addresses on the port,

maybe you have two that come in here, it will shut down the port.

And actually it doesn't-- you know, we've talked about shutdown, right, administratively down.

It doesn't do that, it puts it into a state known as error-disable, which is deceiving

because you'll be doing show commands and it will look like the port is up

or just down like a cable is unplugged, but really it's disabled.

So you have to do some special show commands to seaports that are error-disabled.

Now, protect and restrict are kind of the kinder, gentler ways.

By the way the default is shutdown.

The good thing about shutdown is you know about it.

I mean, as soon as somebody disables the port they now have to call in to tech support

and say "Hey, I-- yeah, sorry, I plugged in what I didn't know."

You know, now-- okay, well, thanks for letting me know,

I'll power that port back on, so you know about it.

But, it also-- I mean, shutdown can be somebody-- taking down your network when,

you know, somebody comes in into the office and they plugged

in a laptop that's not supposed to be there.

What it looks like from their perspective is they'll see the network call active [phonetic]

and then disable itself.

You know, in Windows-- Windows is where you see-- let me drag you down here.

This guy to where you can actually see I'm connected to, you know, such and such network

and if you're not connected, if you've seen that before it goes red

and it disables itself, that's what they see.

They see it go active like this.

It's like, "Hey, I'm online", and then all of a sudden it goes back to red.

So, not knowing exactly what they're doing-- oh no, how do I get my screen back?

[laughs] Oh, there you go, hang on.

There we go.

Not knowing what they're doing, they can start roaming around.

They're like, "Oh, let's try this one.

No? That one doesn't work either.

Oh, let's try this one."

What are they doing?

They're shutting down your network, one port at a time, you know, it's like,

"Go tackle them, stop them from doing that."

So, protect and restrict are kindler or gentler

because what they do is just ignore the violating MAC Address.

So, for instance if they plugged in a wireless access point, all these devices will join,

you know, and the ports-- the port is still working

but it only allows whatever one MAC address has been learned on that port

which is probably the MAC address of the access point.

It only allows that one to work, like this just don't work, or, you know, if I plug--

if I restrict it and say only that MAC address is allowed and I plugged in another device,

it won't shut the port down, it just won't work.

Now, difference-- you might say, what do they have different modes?

The difference between protect and restrict, protect will ignore the offending devices,

it just won't work, and you'll never know about it, actually good.

So, it's doing its job but it's not going to tell you.

Restrict will actually generate a syslog message and say, "Hey, hey,

there's a violation on that port, FYI.

And they'll actually put this little ticker that shows violating counts, they will say one, two--

so you'll actually know, you know, when somebody calls and like "Hey,

my whatever device doesn't work."

you can in and be like, "Oh, well, that's"--

'cause you're plugging it into a port that you're not supposed to plug it into,

you'll actually see the log messages ticking up.

Okay, let me clear off all the chicken scratch and now let's get going with the configuration.

So, I'm going to bring up the connection to our switch,

we got CBT switch, we'll get into privilege mode.

And, I'm going to get into global config-- actually before I do that,

let's do a Show IP Interface Brief so we're able to see what we've got.

Okay, I've got one port, this is my computer that I've plugged

in FastEthernet0/14 which is currently status of up.

Now, these other ones, you can see we've got down, down, that means nothing is plugged

in there and then administratively down,

which means that it is shutdown, we did that in the last nugget.

So, when you go into global config mode and let's get into interface FastEthernet0/14,

and now we're going to-- well, first off let me hit the number 1 thing,

and this is going to take a little explanation.

Before we can do anything we have to convert this port into what's called an access port.

Now, this is a special kind of port and it's difficult to describe

because we haven't truly talked about VLANs yet.

We've covered kind of the concept of them but not really talked about them because--

and we'll find out when we get there that between two switches,

Cisco has a special kind of port that they call a Trunk.

And a Trunk says, "I am going between switches, I send all the VLANs between these switches--

and again, when we'll get to VLANs, we'll talk about that.

Well, Trunks are not valid for port security.

It won't let you because you're not supposed to security between switches

like how many MAC address-- I mean, those are considered trusted links,

support security just doesn't work on a Trunk.

What we want is we want an access port.

Now, access ports are-- think of those as your normal ports.

Those are the ones that are connected to printers and servers and routers and computers

and all of the normal stuff we expect to find.

Access, meaning it accesses one VLAN, that's the big key and it's expected

that one device will be attached.

Now, that's not a rule, that's just kind of gutt expectation.

Now, the default mode on Cisco switches is horrific, I can say that.

It is absolutely horrific.

I'm going to explain more when we get to VLANs, but it is considered dynamic.

And, what that means is this port-- every port, out of the box-- in fact let me show it to you.

We'll go back here, let's a do, show, run.

And you can see that as I scroll into the-- hey look there's our--

these is our encryption keys that we generated for SSH in the last nugget.

So, I look at all my ports and all of them, this is out of the box, have the modes,

switchport mode, dynamic, desirable.

What that means is dynamic, I will change between an access port or a trunk port depending

on what plugs in, I'll detect and I'll try and figure it out, but I really desired

to be a Trunk, that's what the desire is.

So, I'm going to try and be a Trunk but if the other side is like "No,

I'm not a trunk" they'll say, "Okay, fine we'll be an access port."

That's terrific because of security, that means somebody--

if you leave your ports on dynamic somebody can bring in another switch and really mess

up your VLANs and we don't want that, again more on that in the VLAN Nuggets but for now in order

to enable port security we need to make sure that we are set up as access ports.

Well, I'll even prove it to you, I'll go into-- let's say I'm in the port right now

and I'll show you the command, this is how you turn on Port Security I'll type in switchport,

then the command is port security, I hit enter it's like, rejected.

This interface is a dynamic port, you know, it's saying it could be a Trunk

and you can't do Port Security on Trunk so I'm not going to let you do this.

So, the very first command we type in is switchport mode access,

which says I am an access port, I am only going to access end devices, I'm not really designed

to be plugged in to another switch or anything like that, so I am in access port.

Now, we can get into the command I was showing you switchport port-security.

Now, what the-- the command I just typed

in where I type switchport port-security turns it on.

Think of that as your activation button and it's--

I would say probably the number one forgotten command when they're--

people are configuring this 'cause you can configure it all day,

you can say okay maximum is this, this is what happens if somebody violates the policy.

I mean, there's all kinds of things you can do with it but it won't actually work

until you just type in switchport port-security

and hit the enter key but we want to do that last.

We want to get-- and this goes for of most things, we want to get all

of our settings the way that we want them then turn on the feature, we don't want to, you know,

be changing things with it on 'cause it gives you unpredictable results.

So, it's not-- let me provide that.

I'm not saying we're going to blow something up like switch is dead or--

I mean, it is nothing like that but it's just--

you'll be doing configurations and you'll be like, "Oh sorry that's invalid you can't."

And you're like, "Why can't I do that?"

It might just because-- because it's active and online, you know, something may have come

in there that kind of goose up your config.

So, it's best to do the subcommands before we turn this on.

So, first off, let me show you that the one that I would suggest every network do

and that is switchport port-security maximum and whatever the maximum number of address is this,

hopefully you're not going that high, 5,120, maximum number of addresses.

So, between 1 and 5,120.

So, this says, I will allow this mini MAC addresses at a time on the port.

So, if I were to come in here and type in maximum 1 and hit the enter key what

that says is one device at a time can plug in.

Now, it's not-- it's not saying only this device, that's the second form

where it saying what MAC address is on port?

It was just saying only one device.

So, I can switch devices all day long.

As long as there's only one I'm okay.

And, for most people 1 is a good thing to do.

Now, there are some environment specially with voice over IP where you'll have IP phones

that is phones that plugged into the network that are connected to the switch

and then we can daisy chain a computer from that, saves a ton on cabling cost to do

that because in the back of the phone is an incoming switchport and an outgoing switchport,

so I can take the cable plugged in there, and then plugged it right there in the computer.

Now, for those kinds of devices or environments we will have two MAC addresses on a port

so we could do a maximum of two and do that.

So-- and the commands overwrite each other.

So, when I type in 2 it automatically overwrites the 1 and vice versa.

I'm going to keep at 1 because I want to show you what happens

if I blow this us, if I violate the policy.

So, that's first a piece.

Now, I'm going to do switchport port-security, next piece is the violation.

Violation is what will it do if you violate the policy.

What will it do if you exceed the maximum of one MAC address?

And we have shutdown which is the default, which means it will error disable,

the port will no longer work until we as an administrator get involved and re-enable it.

We've got protect and we've got restrict and I describe those.

So, we can type in whatever we want.

I'm going to keep it-- now it's the default but I'll just type it in [inaudible].

Switchport port-security violation shutdown, so that's now in there as well.

From there we typed in-- if we want this is if we want to go

to the next level switchport port-security and we have the MAC address.

If I want to go to this kind of level, or I say, what MAC address is allowed on a port?

I can type in MAC address and literally type in the MAC address that I want to use.

So, a couple ways to get that, one, I can go to a command prompt and do an ipconfig.

Now, you can see ipconfig gives you a kind of the overview, it's the summary.

Here's my first network card, here's my next network card.

But it doesn't give me too much so I'm going to do an ipconfig/all.

And I can look up here at the top and I'm connected

to the switch using my Apple USB adaptor.

And, right below it is the physical address.

You see B8-8D-12-52, that's my MAC address.

Now, Microsoft writes it differently than Cisco does.

Cisco does three sets of four digits each.

So, you know, if I were to translate that I would say, okay B88--

wait, let me just move this up there, b88d.125-- I would have to kind of translate this flavor

into the flavor that Cisco likes and that's fine.

So we can type in that.

And here's another way that we can do it.

I could do a show MAC address-table.

Just let me put my pen down in the table, there you go,

which will show me all the MAC addresses that this switch knows about.

Now, you can see it from there that the switch has a bunch of MAC addresses.

Initially it's like "Wow, what are all those?"

Well, these belong to the switch itself.

My switch, my Cisco 3550, when it communicates we'll use one of these MAC addresses.

It has a lot that it's able to use.

I know this because it says it's a static MAC address, like I can't change it,

it's statically in there, and it's used by the CPU port whereas you can see at the very bottom,

at the bottom I see this MAC address which happens if you look up here, B8-8D.

See that? See that right here between the two?

It's the same MAC address.

It's learned that dynamically on this port.

It's just, that's how the-- that's what this switch does,

it's to learn about those kinds of things.

So, I can take it from there.

That makes a lot easier.

I can just copy and paste it, you know, so that way I save the mistype [phonetic].

So I can do that, you know, switchport, port-security, MAC address and then bam,

paste it in there and I'm good to go.

That would be another way of doing.

Let me show you yet one more and you're go love this one, switchport, port-security,

MAC address, sticky, sticky, sticky, sticky.

Sticky allows you to take what is currently there

and make it the permanent MAC address that's on that port.

Let me show you what I mean.

As soon as I type in sticky, the switch says "Okay,

I will now make whatever MAC address is currently on the port,

the only one that is allowed to use that port" or in this--

this really integrates with this command right here.

Let's say I do a maximum of five, right?

And then I say mac-address sticky.

What it's going to do is learn the first five MAC addresses that come in that port

and then those will be the only five MAC addresses

that are allowed to use that port forevermore.

Pretty cool, huh?

So, it's-- you can think of it like a calculated risk.

You're saying, "Okay, whatever is there right now is good."

So as long as the devices that you think are there are really there you're good.

But if somebody maybe has a-- you know, somebody brought in there laptop from home and plugged it

in for today then sticky is going to make

that laptop the only MAC address allowed on that port.

But I would say, compare that to manually typing MAC addresses

and you probably have a much better chance of-- much less of a chance for error by using sticky

than you do a manually typing in 'cause a mistype

of MAC address causes the port to shutdown too, right?

So, let's go back.

I want to show you-- let's do a show, run and I'm going to zoom

in on the interface FastEthernet0/14.

So, so far, you can see right here, switchport, port-security, mac-address sticky is there.

No, wait a second.

Wait a second.

Didn't I type in a maximum, maximum one?

Yeah, it's right there, it's right there.

I typed it didn't I?

Now, wait, whoa, whoa, wait a second, didn't I typed in switchport,

port-security violation shutdown?

Yeah, it's right there.

Now, how come those aren't showing up in the running config?

The reason why is those are default commands.

Meaning, if I turned on port-security by default it's only going to allow one MAC address.

By default, the violation mode is shutdown.

So, default commands don't show up in the running config.

A matter of fact, do you see shutdown under there?

No. Or-- I should say do see no shutdown under there?

No. And now I could type in shutdown and go back and see, you know,

this interface is now shutdown and I just cut off my computer's connection

so it's now turned off so I see that in there, but when I do a no shutdown,

I don't see the shutdown command anymore because no shutdown,

meaning the port being active is considered a default.

So you're going to see that a lot of times, don't worry about it.

If you type a command and you're like, "Hey, it's not in the running config."

Of course make sure you type the command, but at the same time a lot

of the default commands just don't show up.

So, the last thing I have to-- you know, you might say, "Well,

I expected it to learn your MAC address or something", right?

Isn't that was it does?

But we haven't turned port-security on yet.

Let's do that, I'm going to do switchport, port-security

and hit the enter key, and now we're enabled.

Now, we'll start learning MAC address.

So, I'm going to-- I'm just going to generate some traffic

to make sure that it does get my MAC address.

So let's do a quick ping.

There we go.

Okay, so we've got some traffic going through.

Now I'm going to go back and do a show run fast-- Oh, look at fast [inaudible] 014,

look at what's done, we've got port security which is now on, it's not the default

so it shows up, mac-address sticky is enabled

and all of a sudden we've got this sticky address that has shown up in the list.

That will be the only address, because I have a maximum of one that is in there, because--

and that's going to be now the only address that is allowed.

Now, the thing that I have to make sure of is when I use sticky addresses

like this it's actually making them sticky in the running config.

So, in order for this to say okay, now that will be permanently the only one for all time,

all eternity until you erase this switch and start over.

The only MAC address that's allowed in there, you want to save your config.

Remember, how to do that?

Official Cisco method, copy, run start.

I hit enter, and now we've save our config.

Now, that sticky MAC address is committed that that's going

to be the only that allowed on that port.

Okay, let's do a little verification now.

I'm going to sit on the switch and do a show port security

and you can see here I don't really have too many options,

I have interact you just press the enter key, and it gives me kind of a big picture summary.

It's saying, "Okay, the only secure port that we have is that one, maximum address",

remember I said it was the default is one, current address is one and there--

up till today there has been no security violations, you know.

So at this time no-- nothing is violated, but if somebody does violate it we will shut

down that port, so we can get a little more detailed information,

I can type in show port-security address and this will actually show me the MAC address

that is allowed in the port, and say okay, I've got this address on the security port,

it is a type of secure sticky, okay?

I can go once that-- for this probably the most detailed you'll get.

I'll say interface FastEthernet0/14 and I'll say, okay, port security is enabled,

the status is it is secure and it's up, it's up and running.

Violation mode it will shut me down.

Aging time meaning it will never remove sticky.

You can actually turn on aging that says, "Okay, after we've been idle for, you know, nine hours

or two days or whatever, go ahead and remove the sticky addresses out of this."

That's kind of handy when for instance you are doing in office move and you say, "Okay, well,

you know, I want to kind of age out all these sticky addresses

over the weekend-- excuse me over the weekend.

Now, I have to go in and do a no sticky address, no sticky address."

So you-- you can do that.

So, right now I'm not aging them out.

We've got the maximum MAC address is one, total MAC address once configured, I haven't type in,

in but I do have sticky MAC addresses.

So, this is if you manually type it, this is a bit sticky.

And then it says the last MAC address to access this port is this one,

but no security has been violated.

So, you can kind of read that through in a plain English as you're looking at each one of those.

But I know you send it like come on Jeremy [phonetic],

cause of violation, show me what it does.

Okay. So, what we're going to do is I'm going to unplug--

I actually have two network cards on my computer.

I'm going to unplug my Apple USB adapter and I'm going to plug in, well, this may cause problems.

I just disconnected my-- I guess you opt [phonetic] my production link,

the one that allows me to connect to the internet.

So, I've unplugged one and plugged in another.

So, let's see if we can cause some kind of violation.

So, I'm going to go here, let's do an IP config.

Oh, hey [inaudible] didn't take it long.

It didn't really have to do too much but-- so you can see LAN2 is unplugged.

I plugged LAN1 in.

And, as soon as LAN1 came up essentially went back media disconnected.

Let's look at the messages it says.

It says, error disabled, port secure violation error detected on this, this is now being put

in error disable state, we are terminated, security violation occurred.

Don't you feel like, you know, you're in some kind of like government environment?

Violation occurred caused by MAC address such and such.

It's saying this MAC address is not allowed on that port,

on port FastEthernet0/14, state is change to down.

So now if I were to do the same command we can see that the status has changed

to secure-shut down, like we have violated.

And the cool thing is actually captured the last MAC address to cause this.

So if I'm in a production environment I'm like, "All right, who's that MAC address?"

That's where your work really begins, right, 'cause you got to find out where

in the environment is that MAC address, but the port security has happened.

Now, here's the tough thing.

If I'm looking at who IP Interface Brief or show interface or anything

like that it looks like it's just down.

It doesn't actually go administratively down.

So it can be deceitful because I'm looking, I'm like, okay, it's down,

it looks like nothing is plugged in.

It doesn't actually show me like violation or anything like that.

You have to be under here or I can do a show interface FastEthernet0/14,

which really gives me the needy greedy of it.

And we can see it's actually down, line protocol down, but look at this.

This is the giveaway.

When you see that in parenthesis afterward you're like, ah, okay, so it's something else,

it's been error disabled, like something else is shutting down.

Now, the only-- I'm going to switch my cables back.

So, I'm moving back to my little Apple USB network adapter.

So, the right one, the one that's allowed there, blood rushing into my head,

I'm upside down, all right, there we go.

Plug the originals back in the way they should go.

But it's not going to come back up.

It is going to stay down until I, because I use shutdown mode until I

as an administrator come in and revise it.

Now, the way to get a port out of error disable is to go under that port, shut it down.

Oh, we have to spell it right.

Shut it down and then turn it back on again.

So, shutdown clears the error disable.

No shut down, brings the port back online, okay?

So now that I have the right MAC address in the place I can do a show,

port security interface FastEthernet 0/14, and now we can see okay, we're good again.

We've got the-- we're backup, we're back in action, and, you know, we're chugging along.

And one thing I do-- I want to show you, I paused it [phonetic] and I was like oh,

yeah, wait I want to show you this.

You might be going, well, wait a sec, why is that zero security violation count is zero?

Didn't we violate the policy?

Well, anytime you shut the interface down and then back up, that will zero itself out.

It's very much-- since the interface is been shut

down we've had this many security violations.

Now you notice, right back [inaudible] scroll back up a little bit, right back here.

Can I do that?

Oh, right there, right?

Yeah, right here when we first caused the violation when I did

that command it showed the security violation as one.

Now, if you're using the shutdown mode you probably will never see it go beyond one,

because shutdown, shut support down and you go in and reset it and come back in.

However, if you're using the other methods of violation modes, the protect or restrict,

that one just ignores it when it happens, but that's where you'll see this thing ticker count

up to where it's like, "Oh, we had another violation,

another MAC address, another [inaudible]."

So that one will take up overtime with the other two, but stay at one with the shutdown mode

because it clears every single time you turn the interface off and back on, okay.

So what we have seen here-- isn't that-- I think that's pretty unique.

What we have seen here is how to at least initially secure our switch environment

to make sure that the people that are there belong there,

without getting on my whole soap box again

on controlling the devices that plugged into our network.

This makes sure that we have the ability to have that control.

To where we have the ability to, you know, say what MAC addresses are allowed,

to say how many MAC address is allowed.

Now, is it full proof?

No, security is like an onion, you have layers that you work through.

But people can change their MAC addresses.

You can go into the network properties and Windows and say, "You know,

if you know this is going on and you know what MAC address is allowed on the port?"

Now obviously you're probably malicious if you're doing that,

or/and you really know what's going on.

You kind of know the inner workings of the network.

You can go in and hard-code your MAC address on a rogue device

to match the one that's allowed on the port.

But to do that I mean you really-- I mean that's a malicious person,

that's why we design our network in terms of layers of security instead

of just one method to rule them all.

So, for now in this nugget we have seen port security.

What it is and what is all about?

We've gone through the configuration to limit the devices allowed on a port as well

as limit the ports to specific where you can type them in, and sticky MAC addresses.

I hope this been informative for you and I'd like to thank you for viewing.