DEMO: Port Security

Port Security Options and Defaults

Now that we've learned about port security and how it can mitigate against some different types of attacks, let's learn how to configure it. When it comes to port security there are actually a lot of different options that we have, and since there are so many options there are a lot of different ways we can configure this. Let's cover what those options are, what the defaults are set to, and a few different ways we could set up our ports.

First of all, one thing that we can set is the number of MAC addresses. If we don't set the number of MAC addresses then the default is one, and it will only allow one MAC address. Otherwise we could set up multiple on here.

The next is how do we want it to learn those MAC addresses. We could set it up so it manually learns them, where we type it in, and so then it's in the configuration. We could set it up where it dynamically learns them, which is the default, so if we don't do anything it's just going to dynamically learn. Or we can set it up to be sticky, so once it learns that it actually enters it into the running config, and if you were to save that running config it would go into the startup config.

Then we can set up aging. How long are these MAC addresses going to stay in the system? If we set a time on there — and that's in minutes — it will go for that many minutes and then it ages out that MAC address, and that MAC address will need to be relearned on that interface. The default for that is zero. When you have a zero minute, that is essentially telling the machine that we don't want aging on, and that is the default. So if we don't set any time, the time is zero, which means that it doesn't age out the MAC addresses at all.

We can set it up if we want aging of these static addresses, that is the addresses we manually set up. We can also set up the type of aging that we want, and the default is absolute, which means that the aging timer — how long that MAC address is going to stay in the system — is going to start from the time that that MAC address first communicates on that port. Then the timer starts, and once the timer is up it'll expire that MAC address and then another device can take its place.

If we set it for inactive, then that means it's going to retain that MAC address for the time since the last time that MAC address communicated on the port. So absolute is from the time that you plug in the port and that MAC address communicates; inactive is from the last time that MAC address communicated.

Then we have violation: what's going to happen if the rules are violated. We can shut down the port, which is by default, or we can restrict or protect. Shutdown means that we'd have to manually go and intervene, have to do something. I'm not a big fan of that because it takes up a lot of my time, but that is what the default is. Restrict would shut down the port, and then once it's back into communication into the proper number of MAC addresses, it will turn that port back on. Versus protect: if there are five MAC addresses that are allowed on this port, the sixth one and seventh one and eighth one will not be able to communicate until the aging timer expires on the initial five.

Walking Through Some Configurations

Let's look at a few different configurations here. I'm going to get into the global configuration mode. The first one I'm going to do is just interface fa05, and I want just to turn on port security, so I'm going to turn it on.

So now the question is, how is that port going to respond? The first question I have for you — go ahead and answer this — is how many MAC addresses can I have on fa-05 at any. If you answered one, you would be correct, because one is the default.

The next is how does it learn the MAC addresses.

What would be the aging time? How long would that MAC address, once learned, stay? As long as the system is up and running it's going to continue to keep that, and it will not release that MAC address, so the default time is zero. That timing age starts from the time it first sees the communication because it's absolute, although since the default is zero it really doesn't take effect at this point in time.

And then the violation: what happens if it goes above that one MAC address? The violation type is shutdown, so then it will go into error disabled. That's how you read that.

Next, all of the same is going to be true for fa06, except we're allowing an additional MAC address on that machine, so now it is able to have two MAC addresses on that machine.

Let's do zero seven. This time I'm just manually creating another MAC address on here, so the first MAC address is taken with this A4:4C:C8. That's the MAC address of that machine, which actually happens to be the MAC address of this machine. If I were to open up a command prompt and do ipconfig /all, I could scroll through here. What I'm looking for is not the Wi-Fi connection, because that's going to have a different MAC address, but the one right here: A4 4C C8. That's the one right there. So I've configured it on this device, and now my computer can connect to this port, and then it would allow one other computer to connect to this port.

Next I am going to do fa08. I already mentioned I'm not a big fan of the shutdown, because once something has been violated then I have to manually go in there, shut down the port and then bring it back up to correct it. There's a lot of manual intervention on my side to correct the issue. I don't want that, and so I can choose protect instead. Now what's going to happen is my two devices can connect to this port, because I've got a maximum of two, and the third one or fourth one is not going to be able to connect until those initial two age out. But because the default for this is set to zero for aging, they'll never time out, so no other machine will ever be able to connect once the initial two are taken up.

Next I'm going to do fa09. The difference with this one is the MAC addresses are sticky, which means that those MAC addresses go into the running configuration, and if I want to then save that running configuration it would go into the startup configuration. So this would be where I really want things to be very static on my network.

How about interface fa 010? In this case right here I've got two MAC addresses that are able to connect to this, and they can be on there for 120 minutes. The question for you is, would that 120 minutes be from the time the switch first sees the MAC address, or from the time the MAC address last communicated? From the time that the switch first sees the MAC address — you'd be correct, because that is the default: it's set to absolute.

Let's take a look at fa 011. This is the same thing, except in this case I have my MAC address statically assigned on this interface, so that's what's going to be in the running config at this point in time, and this second MAC address then will expire.

Next I'm going to copy this one, and now I have two MAC addresses that can connect to this port. They'll last 120 minutes, and that is from the time that those MAC addresses last communicated.

Finally, this is the one I'm going to paste on interface 034, because that's the one that my laptop is on right here. This would be the more standard interface that I would probably have on my network. It guards against those attacks we've already talked about, but it also allows me to not have to do any kind of crazy administration to this network. So it's not super secure, but it's secure enough where it's going to mitigate against a lot of the attacks we talked about.

So in this case right here I turn switch port port security on, so I turned it on. I'm going to have a maximum of two, and I might set that for three, four or five. In fact, if this was in a conference room I'd probably assign a few more to it, because I don't want that time when somebody connects in and it's not able to connect. But even if I set this for five, then for the most part it's going to stop those attacks from happening that we talked about.

Then I'm going to say switch port security aging 120, so I've set 120 minutes as being the timeout timer for this. Once again, if this was a conference room I would probably set it for less. I'd probably set it for maybe like 30 minutes — I figure a short meeting would be about 30 minutes — and so maybe I would set this for 30 minutes on here. Then I'm going to do the aging, and maybe I set the type to be inactivity, so the timer is going from the time it last communicated on the network. And then switch port security violation protect.

Those are some of the settings that I would probably set on a lot of my switches to protect against a lot of these attacks, but still not sink a bunch of my time into managing this network.

Verifying the Configuration

A couple of commands on my switch. I'm going to do a show port security interface and then fa 0 34. I can take a look at that and see what the actual end effect is on this port. So it is enabled — that was that first command I entered in. Right now it's secure-up, violation mode is protect, the aging time is 120 minutes, and it's set for the inactivity. There we see one of the MAC addresses in here. Maximum number of MAC addresses is two, although I only have one that's taken up right now.

Then I can do a show port security address. It's not crazy — I've only put this on a few of the ports, and I only really have a device connected into one port, and that's 034. You can see that this one was dynamically learned; I didn't manually configure it. Versus fa-07, I did manually configure that one right there.

The last one I'm going to do is show port security. Now we can see which of these devices — the action that is going to be taken for most of these is going to be shut down, because that's the default. I put a couple of them into protect. And how many addresses are taken up: I've taken up this one here because that one was manually entered in, and I've taken up one here because that was dynamically learned.

So there you have it. There is port security, and how to protect against things like DHCP starvation, or where an attacker is putting a lot of MAC addresses.