Configuring Port Security

Hello! In our previous lesson, we explored how to configure a router to act as a DHCP server and relay agent, automating the assignment of IP addresses. We briefly touched upon the DHCP starvation attack, where an attacker uses a flood of fake MAC addresses to exhaust a DHCP server's IP pool. Today, we'll address that threat head-on.

This lesson focuses on a fundamental Layer 2 security feature: Port Security. Your goal is to learn how to configure port security on a switch to prevent MAC address-based attacks. This is a critical skill for any network administrator, as it serves as the first line of defense for securing access to the wired network. We will cover what port security is, the types of attacks it mitigates, and the practical steps for configuration and verification on a Cisco switch.

1. The Threat: MAC Address Flooding Attacks

Before implementing a solution, it's essential to understand the problem it solves. One of the most common Layer 2 attacks is a MAC Address Flooding Attack, also known as a CAM Table Overflow attack.

As you know, a switch learns the MAC addresses of connected devices and stores them in its MAC address table (or CAM table). It uses this table to make intelligent, unicast forwarding decisions. However, this table has a finite size. In a MAC flooding attack, an attacker connects to a switch port and uses a tool to send a high volume of Ethernet frames, each with a different, bogus source MAC address.

The switch dutifully learns all these fake MAC addresses, and its CAM table quickly fills to capacity. Once full, the switch can no longer learn new, legitimate MAC addresses. In this state, it can no longer make intelligent forwarding decisions. To ensure connectivity, it fails-open, meaning it begins behaving like a hub: it floods all incoming frames (except those from the sender) out of every port. This allows the attacker to capture traffic destined for other hosts on the network, which is a significant security breach.

To see what this attack looks like in practice, the following video demonstrates a MAC flooding attack against a switch using the macof tool in Kali Linux.

2. The Solution: Introducing Port Security

Port security is a Cisco switch feature that gives you precise control over which devices can connect to a specific switch port. It works by limiting the number of MAC addresses that can be learned on an interface and defining what action to take when a violation occurs.

By enabling port security on an access port, you can effectively prevent MAC flooding attacks and stop unauthorized users from simply plugging their devices into an open network jack.

To get a comprehensive overview of what port security is and why we use it, please watch the introduction from Jeremy's IT Lab.

3. Configuring and Verifying Port Security

Now let's move to the practical application. Configuring port security involves several key steps, from basic enablement to defining how violations are handled.

Step 1: Enabling Port Security

Port security can only be configured on a static access port or a static trunk port. By default, Cisco switch ports are in dynamic auto mode, so you must first set the port to access mode.

The following video demonstrates this initial setup and explains the common issue of trying to enable port security on a dynamic port.

Step 2: Setting the Violation Mode

A crucial part of port security is deciding what the switch should do when it detects a violation. A violation can occur in two main ways:

1. An unknown source MAC address sends a frame to the port.
2. The maximum number of allowed MAC addresses is exceeded.

You can configure one of three violation modes:

Mode	Action on Unauthorized Traffic	Port State	Syslog/SNMP Message	Violation Counter
shutdown (default)	Drops packet	err-disabled	Yes (on shutdown)	Increments by 1
restrict	Drops packet	secure-up (operational)	Yes (for each packet)	Increments
protect	Drops packet	secure-up (operational)	No	Does not increment

The shutdown mode is the most secure but also the most disruptive, as it requires administrative intervention to bring the port back online. The restrict mode provides a good balance, blocking malicious traffic and logging the event without disabling the port for legitimate users. The protect mode silently drops traffic without logging, which is generally less useful for monitoring.

Watch this detailed explanation and demonstration of the three violation modes.

Step 3: Handling the err-disabled State

If you use the default shutdown violation mode, a violation will place the port into an err-disabled state. In this state, the port is effectively shut down and will not pass any traffic. To restore service, you must first resolve the cause of the violation (e.g., unplug the unauthorized device) and then re-enable the port.

You can do this in two ways:

1. Manually: Enter the interface configuration, issue a shutdown command, followed by a no shutdown command.
2. Automatically: Configure errdisable recovery. The switch will automatically try to re-enable the port after a configured timer expires.

This next clip shows you how to perform both types of recovery.

Step 4: Configuring Secure MAC Address Learning

The final piece is to tell the switch how to learn the "allowed" MAC addresses.

• Dynamic Learning (Default): The switch learns the source MAC of the first frame(s) it receives, up to the maximum allowed (default is 1). These are stored in the MAC address table but are lost on reboot.
• Static Configuration: You manually specify the exact MAC address allowed on the port using switchport port-security mac-address [mac-address]. This is the most secure method but has high administrative overhead.
• Sticky Learning: This is a hybrid approach. The switch dynamically learns MAC addresses and then "sticks" them to the configuration by automatically creating static entries in the running-config. This is very useful for automating the initial setup.

Other useful options include setting the maximum number of addresses with switchport port-security maximum <number> and configuring how learned addresses age out with switchport port-security aging.

Conclusion

In this lesson, you've taken a significant step in securing your network at Layer 2. By controlling which devices can physically connect and send traffic, you can prevent a range of common attacks and unauthorized access attempts.

Key Takeaways:

• Purpose: Port security mitigates MAC-based attacks like MAC address flooding by limiting and managing the MAC addresses allowed on a switch interface.
• Core Configuration: It requires setting the port to access mode, enabling port security with switchport port-security, and then customizing the behavior.
• Violation Modes: The three modes (shutdown, restrict, protect) determine the switch's reaction to a security breach, offering a trade-off between security and operational availability.
• MAC Learning Methods: Secure MAC addresses can be defined statically, learned dynamically, or learned dynamically and then saved to the configuration using the sticky option.
• Recovery: A port in the err-disabled state (from the shutdown violation mode) must be recovered either manually (shutdown/no shutdown) or via automatic errdisable recovery configuration.

In our next lesson, we will continue our focus on security by moving up from Layer 2 access to Layer 3 management. You will learn how to configure SSH for secure remote management and disable the insecure Telnet protocol, ensuring that your administrative access to network devices is encrypted and protected.