All language subtitles for 14 - Switching - Managing Port Security-eng

>> Imagine with me for a moment that you're
making a recipe, and you're, you know, getting--

assembling all the ingredients together for
this brand new recipe that you're creating,

and you know, five of cups
of sugar, two [laughs]--

actually that's a lot of sugar,
two cups of flour, you know.

And then at the very bottom of the
recipe it says contents of the black bag,

and you go "Well, that's interesting."

And then in parentheses that's
where it says, "Ask your grocer."

So, you go to the grocery store and you're
like, "Hey, I've got this recipe asking

for the black bag, and they
go, "Oh, we know what that is."

And, they go to the back and they pull out this
black bag, no labels or anything like that,

all there is, is a $2.53 price tag.

And you go, "Okay, what's in here?"

And the grocer's like "I don't know.

Honestly a lot of people ask for this, it's
some recipe out there that needs a black bag."

So, you get home and you open up the black
bag and inside is this orange greenish powder

and you're like, "Aah" okay,
so let me ask you right there,

would you feel comfortable pouring
the contents of that black bag

into your recipe not only comfortable with
the five cups of sugar but also that black--

you know, the orange-greenish
powder and kind of mixing up

and making whatever it is that this recipe is?

No, you wouldn't feel comfortable with that.

You're going to be like, "I want
to know what's in that black bag.

I mean for all you know it could be pesticide,
it could be strychnine poison immediate--

I mean it could something really good.

I mean, the point is you don't know, and
that's the whole point of Port Security.

One of the keys to a solid network is knowing
what kind of stuff is attaching to it.

There's this whole new [inaudible] nowadays
and actually if you Google it, B-Y-O-D,

Bring Your Own Device networks, which
is this is a big debate right now going

on in the network community of like, now that
we have all of these kinds of devices, Ipads,

Smartphones, everybody's got their own laptop.

I want to use a McIntosh but my
corporation only supports Windows.

I want to bring my own device.

And, we're in this world now towards like
a B-Y-O-D device world where people expect

that I can just bring whatever I
want and I plug it in my network.

From your perspective it's black bags.

It's people that are bringing-- I mean, inside
this is orange-green powder, is that bad?

I hope not.

But what if somebody brings their own
little black bag that is Strychnine.

It's got a virus, it's got a Trojan, it's--
I mean, I would say at least it's infected

with something that's running peer-to peer file
sharing and it's gobbling up all your bandwidth.

In my opinion, Bring Your
Own Device is a bad idea.

But, corporations are now
expecting it, you know,

management is now approving it not
realizing exactly what they're improving.

So, you're starting to see a lot
of security methods out that there

that help you manage this B-Y-O-D, this kind of
management of the unmanaged world that exist,

so that's what this nugget is
all about, is port security.

How do you manage-- at least to
some level, what kind of devices

or what devices are attaching to your network?

That's what Port Security is all about.

So, we've already stepped a little bit
into this slide by answering the question,

why we care what plugs into our network?

We care because there's just
messed up stuff out there.

I mean, there's-- it's common for
laptops to come in and be infected.

And a matter of fact, one of the businesses

that I operate is a business called
school desk [phonetic] and its goal is

to do a complete IT management
system for schools.

Well, one of the schools that we manage had
a B-Y-O-D Day, essentially for the students.

They said, "Okay, well, this week is"-- I think
it was like midterms or finals or something.

So, we want all of our students-- they
didn't tell me this but they said,

"We want all of our students to
bring in their laptops, their Ipads

or whatever device they feel comfortable
working on from home so that they can work

from the classroom or from the
school on their own device.

Well, come Monday morning "bam"
internet connection is just solid pegged,

the school is calling me, going, "Hey, our
internet connection is down, what's the deal?"

And I said, "I don't know, let me look."

And, I'm starting-- I'm like.

"Hey, there's-- I'm seeing all kinds of devices
that are going up and just trying to gobble

up every single bit of bandwidth
that's available, what's going--

and they go, "Oh, this is a
Bring Your Device to School Day."

And I'm like, "What?"

You know, I'm like, "What?

Who authorized this?"

And so, they-- well, can you find out who
is using all the bandwidth and block them?

And I go, "I can try."

So, sure enough you can-- in Cisco Firewalls,
you can actually identify top users.

And, here's the funny thing, think of it
this way, I had a school that I managed

to use their internet connection which is only
3 megabits per second, they got bonded T1 lines

which feeds this whole school and
they've got all of these new laptops.

So, literally here is me sitting on the--
no, not literally sitting on the Firewall,

but logged into the Firewall and I see--
okay, this guy is eating all the bandwidth

so I'm like, "Okay, block that guy."

A soon as I blocked him, another
guy starts eating all the bandwidth.

I'm like, "Oh, block him."

And finally I called him, I said,
"I can't" I said every single--

it's like, you know, one of those like
crazy sci-fi movies where, you know,

you've got a guy with a sword sitting
there, and all these little lemmings are

like [inaudible] they're running
like trying to beat them all--

this is kind of a weird scenario,
but that's what I felt like.

I'm like, "I can't get them all."

I'm like they're all just running at me.

I'm swinging like mad and I
can't knock them all down.

And, the reason why?

We brought in a whole-- we brought
in hundreds of student laptops.

What do students do in their spare time?

Steal stuff.

[laughs] I'm being serious.

They're on peer-to-peer networks
downloading illegal software, music, games,

and when they do that they infect--
unknowingly they infect their device

with all kinds of stuff.

I mean, the kind of-- anyway, you get my point.

Why do we care what plugs into my network?

I think I've made the case.

Because people bring in things that disrupt the
normal operation of every single day business

at your organization, so that's--
again, that's why I go back

to that Bring Your Own Device
model, is just-- it's crazy.

There's ways that you can
manage it but it just gets ugly.

So, Port Security, the topic-- I feel like
I'm saw [phonetic] box, I'm getting done.

Port Security allows you to restrict
connection to the LAN in two ways.

One, by limiting the number
of MAC addresses per port.

Two, by choosing what MAC
address is allowed on a port.

So, for example, one of the things
that we don't want is somebody

in their cubicle office whatever plugging
in for example a wireless access point

that we don't know about, that is now
broadcasting our network out into the world

and all these strange devices start connecting
and getting into our internal network and,

you know, that's not good for security at all.

So, what I can do is I can say, "Well, I'm only
going to allow one MAC address on that port.

If there's any more than one MAC address that
shows up there, like somebody plugged in this

and all these devices are starting to come in,
disable the port, you know, block the port,

don't allow it to happen, or you know, somebody
tries to build their own little network,

they plug in a little hub or switch
from home that, you know, people--

well, they mean to be harmless
can sometimes do a lot of damage.

I mean, what is that device
that they just plugged in?

They think it's a hub or a switch but
maybe it's one of those, you know,

D-link all in one router switch
devices that are out there.

And, the problem with that is they
just brought in a rogue DHCP server,

not even knowing that that's what they brought
in so it's handing bad IP addresses to the rest

of my network, and all my clients are starting
to get those IP addresses and fall off

because it's on a different subnet
[phonetic] it's on a different--

it's totally different network than
my own, that would be another example.

So, doing-- setting a-- this
is-- I would say a no-brainer.

Almost every company should limit how
many devices are allowed per port.

This one is a little more high maintenance.

For instance I talked to somebody that worked
at the Phoenix Police Department here in Arizona

and they used this to where-- literally they
say, "This PC is plugged into that port,

its MAC address is 0011.bb, you
know, 11.111, something like that,

to where if somebody disconnects that
computer and plugs in any other kind of device

that has a different MAC address, and they all
will, it will immediately shut down that port.

A little higher maintenance because, you
know, for instance moving people around,

connecting devices on a whim goes away.

But, for high level security
that's something that you can do.

Our ports can react and shut
down, protect or restrict modes.

Shutdown does exactly what it says it does.

As soon as you violate the policy, be at
the number of MAC addresses on the port,

maybe you have two that come in
here, it will shut down the port.

And actually it doesn't-- you know, we've talked
about shutdown, right, administratively down.

It doesn't do that, it puts it into a state
known as error-disable, which is deceiving

because you'll be doing show commands
and it will look like the port is up

or just down like a cable is
unplugged, but really it's disabled.

So you have to do some special show
commands to seaports that are error-disabled.

Now, protect and restrict are
kind of the kinder, gentler ways.

By the way the default is shutdown.

The good thing about shutdown
is you know about it.

I mean, as soon as somebody disables the
port they now have to call in to tech support

and say "Hey, I-- yeah, sorry, I
plugged in what I didn't know."

You know, now-- okay, well,
thanks for letting me know,

I'll power that port back
on, so you know about it.

But, it also-- I mean, shutdown can be
somebody-- taking down your network when,

you know, somebody comes in
into the office and they plugged

in a laptop that's not supposed to be there.

What it looks like from their perspective is
they'll see the network call active [phonetic]

and then disable itself.

You know, in Windows-- Windows is where
you see-- let me drag you down here.

This guy to where you can actually see I'm
connected to, you know, such and such network

and if you're not connected, if
you've seen that before it goes red

and it disables itself, that's what they see.

They see it go active like this.

It's like, "Hey, I'm online", and then
all of a sudden it goes back to red.

So, not knowing exactly what they're
doing-- oh no, how do I get my screen back?

[laughs] Oh, there you go, hang on.

There we go.

Not knowing what they're doing,
they can start roaming around.

They're like, "Oh, let's try this one.

No? That one doesn't work either.

Oh, let's try this one."

What are they doing?

They're shutting down your network, one
port at a time, you know, it's like,

"Go tackle them, stop them from doing that."

So, protect and restrict are kindler or gentler

because what they do is just
ignore the violating MAC Address.

So, for instance if they plugged in a wireless
access point, all these devices will join,

you know, and the ports--
the port is still working

but it only allows whatever one MAC
address has been learned on that port

which is probably the MAC
address of the access point.

It only allows that one to work, like this
just don't work, or, you know, if I plug--

if I restrict it and say only that MAC address
is allowed and I plugged in another device,

it won't shut the port down, it just won't work.

Now, difference-- you might say,
what do they have different modes?

The difference between protect and restrict,
protect will ignore the offending devices,

it just won't work, and you'll
never know about it, actually good.

So, it's doing its job but
it's not going to tell you.

Restrict will actually generate a
syslog message and say, "Hey, hey,

there's a violation on that port, FYI.

And they'll actually put this little ticker that
shows violating counts, they will say one, two--

so you'll actually know, you know,
when somebody calls and like "Hey,

my whatever device doesn't work."

you can in and be like, "Oh, well, that's"--

'cause you're plugging it into a port
that you're not supposed to plug it into,

you'll actually see the log messages ticking up.

Okay, let me clear off all the chicken scratch
and now let's get going with the configuration.

So, I'm going to bring up
the connection to our switch,

we got CBT switch, we'll
get into privilege mode.

And, I'm going to get into global
config-- actually before I do that,

let's do a Show IP Interface Brief
so we're able to see what we've got.

Okay, I've got one port, this
is my computer that I've plugged

in FastEthernet0/14 which
is currently status of up.

Now, these other ones, you can see we've got
down, down, that means nothing is plugged

in there and then administratively down,

which means that it is shutdown,
we did that in the last nugget.

So, when you go into global config mode and
let's get into interface FastEthernet0/14,

and now we're going to-- well, first
off let me hit the number 1 thing,

and this is going to take a little explanation.

Before we can do anything we have to convert
this port into what's called an access port.

Now, this is a special kind of
port and it's difficult to describe

because we haven't truly talked about VLANs yet.

We've covered kind of the concept of them
but not really talked about them because--

and we'll find out when we get
there that between two switches,

Cisco has a special kind of
port that they call a Trunk.

And a Trunk says, "I am going between switches,
I send all the VLANs between these switches--

and again, when we'll get to
VLANs, we'll talk about that.

Well, Trunks are not valid for port security.

It won't let you because you're not
supposed to security between switches

like how many MAC address-- I mean,
those are considered trusted links,

support security just doesn't work on a Trunk.

What we want is we want an access port.

Now, access ports are-- think
of those as your normal ports.

Those are the ones that are connected to
printers and servers and routers and computers

and all of the normal stuff we expect to find.

Access, meaning it accesses one VLAN,
that's the big key and it's expected

that one device will be attached.

Now, that's not a rule, that's
just kind of gutt expectation.

Now, the default mode on Cisco
switches is horrific, I can say that.

It is absolutely horrific.

I'm going to explain more when we get
to VLANs, but it is considered dynamic.

And, what that means is this port-- every port,
out of the box-- in fact let me show it to you.

We'll go back here, let's a do, show, run.

And you can see that as I scroll
into the-- hey look there's our--

these is our encryption keys that we
generated for SSH in the last nugget.

So, I look at all my ports and all of them,
this is out of the box, have the modes,

switchport mode, dynamic, desirable.

What that means is dynamic, I will change
between an access port or a trunk port depending

on what plugs in, I'll detect and I'll try
and figure it out, but I really desired

to be a Trunk, that's what the desire is.

So, I'm going to try and be a Trunk
but if the other side is like "No,

I'm not a trunk" they'll say, "Okay,
fine we'll be an access port."

That's terrific because of
security, that means somebody--

if you leave your ports on dynamic somebody
can bring in another switch and really mess

up your VLANs and we don't want that, again more
on that in the VLAN Nuggets but for now in order

to enable port security we need to make
sure that we are set up as access ports.

Well, I'll even prove it to you, I'll go
into-- let's say I'm in the port right now

and I'll show you the command, this is how you
turn on Port Security I'll type in switchport,

then the command is port security,
I hit enter it's like, rejected.

This interface is a dynamic port, you
know, it's saying it could be a Trunk

and you can't do Port Security on Trunk
so I'm not going to let you do this.

So, the very first command we
type in is switchport mode access,

which says I am an access port, I am only going
to access end devices, I'm not really designed

to be plugged in to another switch or
anything like that, so I am in access port.

Now, we can get into the command I was
showing you switchport port-security.

Now, what the-- the command I just typed

in where I type switchport
port-security turns it on.

Think of that as your activation
button and it's--

I would say probably the number one
forgotten command when they're--

people are configuring this 'cause
you can configure it all day,

you can say okay maximum is this, this is
what happens if somebody violates the policy.

I mean, there's all kinds of things you
can do with it but it won't actually work

until you just type in switchport port-security

and hit the enter key but
we want to do that last.

We want to get-- and this goes for
of most things, we want to get all

of our settings the way that we want them then
turn on the feature, we don't want to, you know,

be changing things with it on 'cause
it gives you unpredictable results.

So, it's not-- let me provide that.

I'm not saying we're going to blow
something up like switch is dead or--

I mean, it is nothing like that but it's just--

you'll be doing configurations and you'll be
like, "Oh sorry that's invalid you can't."

And you're like, "Why can't I do that?"

It might just because-- because it's active
and online, you know, something may have come

in there that kind of goose up your config.

So, it's best to do the subcommands
before we turn this on.

So, first off, let me show you that the
one that I would suggest every network do

and that is switchport port-security maximum and
whatever the maximum number of address is this,

hopefully you're not going that high,
5,120, maximum number of addresses.

So, between 1 and 5,120.

So, this says, I will allow this mini
MAC addresses at a time on the port.

So, if I were to come in here and type
in maximum 1 and hit the enter key what

that says is one device at a time can plug in.

Now, it's not-- it's not saying only
this device, that's the second form

where it saying what MAC address is on port?

It was just saying only one device.

So, I can switch devices all day long.

As long as there's only one I'm okay.

And, for most people 1 is a good thing to do.

Now, there are some environment specially
with voice over IP where you'll have IP phones

that is phones that plugged into the
network that are connected to the switch

and then we can daisy chain a computer from
that, saves a ton on cabling cost to do

that because in the back of the phone is an
incoming switchport and an outgoing switchport,

so I can take the cable plugged in there, and
then plugged it right there in the computer.

Now, for those kinds of devices or environments
we will have two MAC addresses on a port

so we could do a maximum of two and do that.

So-- and the commands overwrite each other.

So, when I type in 2 it automatically
overwrites the 1 and vice versa.

I'm going to keep at 1 because
I want to show you what happens

if I blow this us, if I violate the policy.

So, that's first a piece.

Now, I'm going to do switchport
port-security, next piece is the violation.

Violation is what will it do
if you violate the policy.

What will it do if you exceed
the maximum of one MAC address?

And we have shutdown which is the
default, which means it will error disable,

the port will no longer work until we as an
administrator get involved and re-enable it.

We've got protect and we've got
restrict and I describe those.

So, we can type in whatever we want.

I'm going to keep it-- now it's the default
but I'll just type it in [inaudible].

Switchport port-security violation
shutdown, so that's now in there as well.

From there we typed in-- if we
want this is if we want to go

to the next level switchport
port-security and we have the MAC address.

If I want to go to this kind of level, or I
say, what MAC address is allowed on a port?

I can type in MAC address and literally
type in the MAC address that I want to use.

So, a couple ways to get that, one, I can
go to a command prompt and do an ipconfig.

Now, you can see ipconfig gives you a
kind of the overview, it's the summary.

Here's my first network card,
here's my next network card.

But it doesn't give me too much so
I'm going to do an ipconfig/all.

And I can look up here at
the top and I'm connected

to the switch using my Apple USB adaptor.

And, right below it is the physical address.

You see B8-8D-12-52, that's my MAC address.

Now, Microsoft writes it
differently than Cisco does.

Cisco does three sets of four digits each.

So, you know, if I were to translate
that I would say, okay B88--

wait, let me just move this up there, b88d.125--
I would have to kind of translate this flavor

into the flavor that Cisco
likes and that's fine.

So we can type in that.

And here's another way that we can do it.

I could do a show MAC address-table.

Just let me put my pen down
in the table, there you go,

which will show me all the MAC
addresses that this switch knows about.

Now, you can see it from there that the
switch has a bunch of MAC addresses.

Initially it's like "Wow, what are all those?"

Well, these belong to the switch itself.

My switch, my Cisco 3550, when it communicates
we'll use one of these MAC addresses.

It has a lot that it's able to use.

I know this because it says it's a static
MAC address, like I can't change it,

it's statically in there, and it's used by the
CPU port whereas you can see at the very bottom,

at the bottom I see this MAC address
which happens if you look up here, B8-8D.

See that? See that right here between the two?

It's the same MAC address.

It's learned that dynamically on this port.

It's just, that's how the--
that's what this switch does,

it's to learn about those kinds of things.

So, I can take it from there.

That makes a lot easier.

I can just copy and paste it, you know,
so that way I save the mistype [phonetic].

So I can do that, you know, switchport,
port-security, MAC address and then bam,

paste it in there and I'm good to go.

That would be another way of doing.

Let me show you yet one more and you're go
love this one, switchport, port-security,

MAC address, sticky, sticky, sticky, sticky.

Sticky allows you to take
what is currently there

and make it the permanent MAC
address that's on that port.

Let me show you what I mean.

As soon as I type in sticky,
the switch says "Okay,

I will now make whatever MAC
address is currently on the port,

the only one that is allowed
to use that port" or in this--

this really integrates with
this command right here.

Let's say I do a maximum of five, right?

And then I say mac-address sticky.

What it's going to do is learn the first
five MAC addresses that come in that port

and then those will be the
only five MAC addresses

that are allowed to use that port forevermore.

Pretty cool, huh?

So, it's-- you can think of
it like a calculated risk.

You're saying, "Okay, whatever
is there right now is good."

So as long as the devices that you think
are there are really there you're good.

But if somebody maybe has a-- you know, somebody
brought in there laptop from home and plugged it

in for today then sticky is going to make

that laptop the only MAC
address allowed on that port.

But I would say, compare that
to manually typing MAC addresses

and you probably have a much better chance of--
much less of a chance for error by using sticky

than you do a manually typing
in 'cause a mistype

of MAC address causes the
port to shutdown too, right?

So, let's go back.

I want to show you-- let's do a
show, run and I'm going to zoom

in on the interface FastEthernet0/14.

So, so far, you can see right here, switchport,
port-security, mac-address sticky is there.

No, wait a second.

Wait a second.

Didn't I type in a maximum, maximum one?

Yeah, it's right there, it's right there.

I typed it didn't I?

Now, wait, whoa, whoa, wait a
second, didn't I typed in switchport,

port-security violation shutdown?

Yeah, it's right there.

Now, how come those aren't
showing up in the running config?

The reason why is those are default commands.

Meaning, if I turned on port-security by default
it's only going to allow one MAC address.

By default, the violation mode is shutdown.

So, default commands don't
show up in the running config.

A matter of fact, do you
see shutdown under there?

No. Or-- I should say do
see no shutdown under there?

No. And now I could type in shutdown
and go back and see, you know,

this interface is now shutdown and I
just cut off my computer's connection

so it's now turned off so I see that
in there, but when I do a no shutdown,

I don't see the shutdown command
anymore because no shutdown,

meaning the port being active
is considered a default.

So you're going to see that a lot
of times, don't worry about it.

If you type a command and you're like,
"Hey, it's not in the running config."

Of course make sure you type the
command, but at the same time a lot

of the default commands just don't show up.

So, the last thing I have to--
you know, you might say, "Well,

I expected it to learn your MAC
address or something", right?

Isn't that was it does?

But we haven't turned port-security on yet.

Let's do that, I'm going to
do switchport, port-security

and hit the enter key, and now we're enabled.

Now, we'll start learning MAC address.

So, I'm going to-- I'm just
going to generate some traffic

to make sure that it does get my MAC address.

So let's do a quick ping.

There we go.

Okay, so we've got some traffic going through.

Now I'm going to go back and do a show run
fast-- Oh, look at fast [inaudible] 014,

look at what's done, we've got port security
which is now on, it's not the default

so it shows up, mac-address sticky is enabled

and all of a sudden we've got this sticky
address that has shown up in the list.

That will be the only address, because I have
a maximum of one that is in there, because--

and that's going to be now the
only address that is allowed.

Now, the thing that I have to make
sure of is when I use sticky addresses

like this it's actually making
them sticky in the running config.

So, in order for this to say okay, now that
will be permanently the only one for all time,

all eternity until you erase
this switch and start over.

The only MAC address that's allowed in
there, you want to save your config.

Remember, how to do that?

Official Cisco method, copy, run start.

I hit enter, and now we've save our config.

Now, that sticky MAC address
is committed that that's going

to be the only that allowed on that port.

Okay, let's do a little verification now.

I'm going to sit on the switch
and do a show port security

and you can see here I don't
really have too many options,

I have interact you just press the enter key,
and it gives me kind of a big picture summary.

It's saying, "Okay, the only secure port
that we have is that one, maximum address",

remember I said it was the default is
one, current address is one and there--

up till today there has been no
security violations, you know.

So at this time no-- nothing is violated,
but if somebody does violate it we will shut

down that port, so we can get a
little more detailed information,

I can type in show port-security address and
this will actually show me the MAC address

that is allowed in the port, and say okay,
I've got this address on the security port,

it is a type of secure sticky, okay?

I can go once that-- for this
probably the most detailed you'll get.

I'll say interface FastEthernet0/14 and
I'll say, okay, port security is enabled,

the status is it is secure and
it's up, it's up and running.

Violation mode it will shut me down.

Aging time meaning it will never remove sticky.

You can actually turn on aging that says, "Okay,
after we've been idle for, you know, nine hours

or two days or whatever, go ahead and
remove the sticky addresses out of this."

That's kind of handy when for instance you are
doing in office move and you say, "Okay, well,

you know, I want to kind of age
out all these sticky addresses

over the weekend-- excuse me over the weekend.

Now, I have to go in and do a no
sticky address, no sticky address."

So you-- you can do that.

So, right now I'm not aging them out.

We've got the maximum MAC address is one, total
MAC address once configured, I haven't type in,

in but I do have sticky MAC addresses.

So, this is if you manually
type it, this is a bit sticky.

And then it says the last MAC address
to access this port is this one,

but no security has been violated.

So, you can kind of read that through in a plain
English as you're looking at each one of those.

But I know you send it like
come on Jeremy [phonetic],

cause of violation, show me what it does.

Okay. So, what we're going to
do is I'm going to unplug--

I actually have two network
cards on my computer.

I'm going to unplug my Apple USB adapter and I'm
going to plug in, well, this may cause problems.

I just disconnected my-- I guess you
opt [phonetic] my production link,

the one that allows me to
connect to the internet.

So, I've unplugged one and plugged in another.

So, let's see if we can cause
some kind of violation.

So, I'm going to go here, let's do an IP config.

Oh, hey [inaudible] didn't take it long.

It didn't really have to do too much
but-- so you can see LAN2 is unplugged.

I plugged LAN1 in.

And, as soon as LAN1 came up
essentially went back media disconnected.

Let's look at the messages it says.

It says, error disabled, port secure violation
error detected on this, this is now being put

in error disable state, we are
terminated, security violation occurred.

Don't you feel like, you know, you're in
some kind of like government environment?

Violation occurred caused by
MAC address such and such.

It's saying this MAC address
is not allowed on that port,

on port FastEthernet0/14,
state is change to down.

So now if I were to do the same command
we can see that the status has changed

to secure-shut down, like we have violated.

And the cool thing is actually captured
the last MAC address to cause this.

So if I'm in a production environment I'm
like, "All right, who's that MAC address?"

That's where your work really begins,
right, 'cause you got to find out where

in the environment is that MAC address,
but the port security has happened.

Now, here's the tough thing.

If I'm looking at who IP Interface
Brief or show interface or anything

like that it looks like it's just down.

It doesn't actually go administratively down.

So it can be deceitful because I'm
looking, I'm like, okay, it's down,

it looks like nothing is plugged in.

It doesn't actually show me like
violation or anything like that.

You have to be under here or I can
do a show interface FastEthernet0/14,

which really gives me the needy greedy of it.

And we can see it's actually down,
line protocol down, but look at this.

This is the giveaway.

When you see that in parenthesis afterward
you're like, ah, okay, so it's something else,

it's been error disabled, like
something else is shutting down.

Now, the only-- I'm going
to switch my cables back.

So, I'm moving back to my little
Apple USB network adapter.

So, the right one, the one that's allowed
there, blood rushing into my head,

I'm upside down, all right, there we go.

Plug the originals back in
the way they should go.

But it's not going to come back up.

It is going to stay down until I,
because I use shutdown mode until I

as an administrator come in and revise it.

Now, the way to get a port out of error
disable is to go under that port, shut it down.

Oh, we have to spell it right.

Shut it down and then turn it back on again.

So, shutdown clears the error disable.

No shut down, brings the port back online, okay?

So now that I have the right MAC
address in the place I can do a show,

port security interface FastEthernet 0/14,
and now we can see okay, we're good again.

We've got the-- we're backup, we're back in
action, and, you know, we're chugging along.

And one thing I do-- I want to show you,
I paused it [phonetic] and I was like oh,

yeah, wait I want to show you this.

You might be going, well, wait a sec, why is
that zero security violation count is zero?

Didn't we violate the policy?

Well, anytime you shut the interface down
and then back up, that will zero itself out.

It's very much-- since the
interface is been shut

down we've had this many security violations.

Now you notice, right back [inaudible]
scroll back up a little bit, right back here.

Can I do that?

Oh, right there, right?

Yeah, right here when we first
caused the violation when I did

that command it showed the
security violation as one.

Now, if you're using the shutdown mode you
probably will never see it go beyond one,

because shutdown, shut support down and
you go in and reset it and come back in.

However, if you're using the other methods
of violation modes, the protect or restrict,

that one just ignores it when it happens, but
that's where you'll see this thing ticker count

up to where it's like, "Oh,
we had another violation,

another MAC address, another [inaudible]."

So that one will take up overtime with the other
two, but stay at one with the shutdown mode

because it clears every single time you
turn the interface off and back on, okay.

So what we have seen here-- isn't
that-- I think that's pretty unique.

What we have seen here is how to at least
initially secure our switch environment

to make sure that the people
that are there belong there,

without getting on my whole soap box again

on controlling the devices
that plugged into our network.

This makes sure that we have the
ability to have that control.

To where we have the ability to, you
know, say what MAC addresses are allowed,

to say how many MAC address is allowed.

Now, is it full proof?

No, security is like an onion, you
have layers that you work through.

But people can change their MAC addresses.

You can go into the network properties
and Windows and say, "You know,

if you know this is going on and you know
what MAC address is allowed on the port?"

Now obviously you're probably
malicious if you're doing that,

or/and you really know what's going on.

You kind of know the inner
workings of the network.

You can go in and hard-code your
MAC address on a rogue device

to match the one that's allowed on the port.

But to do that I mean you really--
I mean that's a malicious person,

that's why we design our network in
terms of layers of security instead

of just one method to rule them all.

So, for now in this nugget
we have seen port security.

What it is and what is all about?

We've gone through the configuration to
limit the devices allowed on a port as well

as limit the ports to specific where you
can type them in, and sticky MAC addresses.

I hope this been informative for you
and I'd like to thank you for viewing.