Overblog
Edit post Follow this blog Administration + Create my blog
Cisco & Cisco Network Hardware News and Technology

Switchport Security Configuration

March 25 2013 , Written by Cisco & Cisco Router, Network Switch Published on #Cisco & Cisco Network

The switchport security feature (Port Security) is an important piece of the network switch security puzzle; it provides the ability to limit what addresses will be allowed to send traffic on individual switchports within the switched network.

 

Once an organization decides to utilize the switchport security feature on their networks, it is important to carefully plan before any configuration is put in place. While the switchport security feature is very useful if used correctly, it can easily be misconfigured; this misconfiguration can cause service interruption and ongoing headaches for an organization. The planning of the configuration includes determining which violation mode and operation mode to use based on the goals of the organization, as well as determining which switchports should be enabled with the feature. This article takes a look at how the switchport security feature is configured by extending on the concepts that were covered in Switchport Security.

 

Switchport Security Configuration

By default, the switchport security feature is disabled on all switchports and must be enabled. Table 1 shows the steps required to enable the switchport security feature on an interface (This can cause some confusion, but when using Cisco IOS, switchport configuration is performed while in interface configuration mode. The terms interface and switchport are interchangeable).

Enter privileged mode

router>enable

Enter global configuration mode

router#configure terminal

Enter interface configuration mode

router(config)#interface interface

Enable the switchport security feature

router(config-if)#switchport port-security

Without configuring any other specific parameters, the switchport security feature will only permit one MAC address to be learned per switchport (dynamically) and use the shutdown violation mode; this means that if a second MAC address is seen on the switchport the port will be shut down and put into the err-disabled state.

 

Table 2 shows the steps required to alter these default parameters:

Enter privileged mode

router>enable

Enter global configuration mode

router#configure terminal

Enter interface configuration mode

router(config)#interface interface

Configure the maximum number of MAC addresses allowed on a switchport (default : 1)

router(config-if)#switchport port-security maximum value

Configure the switchport violation mode (default : shutdown)

router(config-if)#switchport port-security violation {protect |restrict | shutdown}

 

As stated above, by default MAC addresses are learned on a switchport dynamically and are called dynamic MAC addresses. MAC addresses can also be configured in two other ways: statically and sticky. Static MAC addresses can be configured on a switchport to ensure that only a device with a specific MAC can utilize a switchport (for example, if the switchport location and a device are publically accessible and the organization wants to ensure only that authorized device can access the network). A sticky MAC address is a hybrid between a static and dynamic MAC address.  When it is dynamically learned, the MAC address is automatically entered into the running configuration as a static MAC address; the address is then kept in the running configuration until a reboot. On reboot, the MAC address will be lost; if the network engineer wants to keep the MAC address across a reboot a configuration save is required (copy running startup).

Table 3 shows the steps required to configure a static MAC address:

Enter global configuration mode

router#configure terminal

Enter interface configuration mode

router(config)#interface interface

Configure a static MAC address

router(config-if)#switchport port-security mac-address mac-address

 

Table 4 shows the steps required to enable the use of sticky learning on a switchport:

Enter global configuration mode

router#configure terminal

Enter interface configuration mode

router(config)#interface interface

Enabling the use of sticky MAC address learning

router(config-if)#switchport port-security mac-address sticky

 

Switchport Security Configuration Example

To wrap the configuration commands into a single example to ensure clarity, this section will show a basic switchport security example.

 

The configuration shown in Table 5 will enable the use of the switchport security feature on ports f0/1 and f0/2, statically configure the 0000.1111.2222 MAC address on the f0/1 switchport and enable sticky learning on the f0/2 switchport.

Enter global configuration mode

router#configure terminal

Enter interface configuration mode

router(config)#interface f0/1

Enabling the switchport security feature

router(config-if)#switchport port-security

Configuring a static MAC Address (0000.1111.2222) on the switchport.

router(config-if)#switchport port-security mac-address0000.1111.2222

Enter interface configuration mode

router(config)#interface f0/2

Enabling the switchport security feature

router(config-if)#switchport port-security

Configuring the use of sticky MAC address learning

router(config-if)#switchport port-security mac-address sticky

 

While the switchport security feature does not require that many commands to operate properly, it can also be misconfigured just as easily. Take the time to write down and triple-check that the proposed configuration is doing what is expected, and/or test a proposed configuration in a non-production environment. Hopefully the content in this article can be used to get started with the switchport security feature.

 

More Related Topics:

What is Switchport Security?

Switchport Security & Configuration

How to Know What Device is on What Port on a Cisco Switch?

Cisco Switch Port Security ---How to Configure Switch Security?

How to Set Port Security on a Cisco Catalyst Switch?

Share this post
Repost0
To be informed of the latest articles, subscribe:
Comment on this post