Configuring Port Security

1. What is Port Security and Why Use It?

At its core, port security is a feature that restricts a switch port's usage to a specific MAC address or a set number of MAC addresses. When you enable it, the switch monitors incoming frames on that port and takes a specific action if a violation occurs.

In the previous lesson, we saw how an attacker could use a tool like Macof to send thousands of frames with bogus source MAC addresses, overwhelming the switch's CAM table. Port security directly counters this by limiting the number of MAC addresses a single port is allowed to learn.

To get a comprehensive overview of what port security is and the problems it solves, please watch the following video.

2. Configuring Port Security

Configuring port security involves a few key steps. First, the interface must be manually set as either an access or a trunk port; port security cannot be enabled on a port in a dynamic state (like dynamic auto). Once that's done, you can enable port security and customize its behavior.

Basic Configuration Steps

1. Set the Interface Mode: Enter interface configuration mode and set the port to a static mode.

   Switch(config-if)# switchport mode access
   

2. Enable Port Security: Turn on the port security feature for that interface.

   Switch(config-if)# switchport port-security
   

At this point, port security is active with its default settings:

• Maximum MAC Addresses: 1
• Violation Mode: shutdown
• MAC Address Learning: The first source MAC address seen on the port will be learned dynamically and become the only allowed address.

Customizing Port Security

While the defaults are effective, you'll often want to tailor the configuration. Here are the most common commands:

• Set the Maximum Number of Addresses:

  Switch(config-if)# switchport port-security maximum [number]
  

  This is essential for ports connected to devices like an IP phone that has a PC daisy-chained to it, which would require a maximum of at least 2.

• Define the Violation Action:

  Switch(config-if)# switchport port-security violation [shutdown | restrict | protect]
  

  We will explore these modes in detail in the next section.

• Set the Allowed MAC Addresses: You have two main options:

  • Statically define an address:

    Switch(config-if)# switchport port-security mac-address [mac_address]
    

  • Enable "sticky" learning: This tells the switch to dynamically learn MAC addresses and automatically add them to the running configuration as if they were statically configured. This is a very efficient way to secure ports without manually typing every MAC address.

    Switch(config-if)# switchport port-security mac-address sticky
    

For a step-by-step guide through these commands, the following article provides a clear, text-based summary.

3. Understanding Violation Modes

What happens when an unauthorized device connects? The violation mode determines the switch's response. This is a critical setting that balances security with operational overhead.

The three violation modes are:

• shutdown (default): The most secure mode. Upon violation, the switch places the port in an err-disabled state, effectively shutting it down. It also sends a syslog message. The port will not function until an administrator manually intervenes (shutdown, then no shutdown) or until an automatic recovery timer expires (if configured).
• restrict: A less disruptive mode. The switch drops all packets from unauthorized MAC addresses. It increments the security violation counter and sends a syslog message. Legitimate traffic is still permitted.
• protect: The "silent" mode. The switch drops all packets from unauthorized MAC addresses but does not send any syslog messages or increment the violation counter. This prevents the unauthorized device from communicating but provides no notification of the attempt.

This table provides a great visual summary of the differences:

To see a demonstration of how these modes are configured and how the switch behaves in each state, please watch the next segment of the video from Jeremy's IT Lab.

4. Practical Application and Verification

Now, let's see how these configurations are applied in a lab environment. The following video demonstrates the setup and verification of port security on multiple switches with different requirements.

As demonstrated, you can verify your configuration and check the operational status using several powerful show commands:

• show port-security interface [interface-id]: This is your most detailed view. It shows if port security is enabled, the port status (e.g., secure-up, secure-shutdown), the violation mode, maximum MAC addresses, and the violation count.
• show port-security: Provides a summary of all interfaces with port security enabled.
• show port-security address: Displays all the secure MAC addresses learned or configured on the switch.
• show mac address-table secure: A specific command to view the secure MAC addresses within the switch's main address table.

Conclusion

You have now learned how to configure port security, a powerful and essential tool for protecting the access layer of your network. By controlling which devices can connect to your switch ports, you create a strong first line of defense against both simple unauthorized access and more complex attacks.

Key Takeaways:

• Purpose: Port security mitigates unauthorized access and MAC flooding attacks by limiting the number and identity of source MAC addresses on an interface.
• Prerequisite: The switchport must be in access or trunk mode.
• Core Commands:
  • switchport port-security to enable.
  • switchport port-security maximum [value] to set the limit.
  • switchport port-security mac-address [mac | sticky] to define allowed addresses.
  • switchport port-security violation [shutdown | restrict | protect] to set the penalty.
• Violation Modes: shutdown disables the port, restrict drops traffic and logs the event, and protect silently drops traffic.
• Verification: Use show port-security interface [id] for detailed status and show port-security address to see learned MACs.

In our previous lesson, we also discussed DHCP spoofing attacks. Having now secured our ports against unauthorized MACs, our next lesson will address this threat directly by teaching you how to configure DHCP snooping to validate DHCP messages and prevent rogue servers.