Scribd
Upload
121 views13 pages

Port Security

The document discusses configuring and verifying port security on Cisco switches. It covers enabling port security on interfaces, setting maximum MAC addresses and violations, learning MAC addresses dynamically, recovering from port security violations, and commands for verifying port security configuration and status.

Uploaded by

Tri Le
Copyright
© Attribution Non-Commercial (BY-NC)
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PPTX, PDF, TXT or read online on Scribd
121 views13 pages

Port Security

The document discusses configuring and verifying port security on Cisco switches. It covers enabling port security on interfaces, setting maximum MAC addresses and violations, learning MAC addresses dynamically, recovering from port security violations, and commands for verifying port security configuration and status.

Uploaded by

Tri Le
Copyright
© Attribution Non-Commercial (BY-NC)
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PPTX, PDF, TXT or read online on Scribd
You are on page 1/ 13

Port Security

down up errdisable Administrative down

A B

S(config)# interface fa0/1 S(config-if)# switchport mode access S(config-if)# switchport port-security S(config-if)# switchport port-security maximum 1 S(config-if)# switchport port-security mac-address 0000.0001.000A S(config-if)# switchport port-security violation shutdown

2007 Cisco Systems, Inc. All rights reserved.

ICND1 v1.02-1

Port Security
B A
up

S(config)# interface fa0/1 S(config-if)# switchport mode access S(config-if)# switchport port-security S(config-if)# switchport port-security S(config-if)# switchport port-security S(config-if)# switchport port-security S(config-if)# switchport port-security

maximum 2 mac-address 0000.0001.000A mac-address 0000.0001.000B violation shutdown

2007 Cisco Systems, Inc. All rights reserved.

ICND1 v1.02-2

Port Security
C B A
up

S(config)# interface fa0/1 S(config-if)# switchport mode access S(config-if)# switchport port-security S(config-if)# switchport port-security S(config-if)# switchport port-security S(config-if)# switchport port-security S(config-if)# switchport port-security

maximum 2 mac-address 0000.0001.000A mac-address 0000.0001.000B violation shutdown

2007 Cisco Systems, Inc. All rights reserved.

ICND1 v1.02-3

Port Security
B A
up

S(config)# interface fa0/1 S(config-if)# switchport mode access S(config-if)# switchport port-security S(config-if)# switchport port-security maximum 2 S(config-if)# switchport port-security mac-address sticky S(config-if)# switchport port-security violation shutdown

Switch t ng hoc n MAC u tin bng cach cm ln lt n PC, ri ping t PC


2007 Cisco Systems, Inc. All rights reserved. ICND1 v1.02-4

Port Security
B A
up

S(config)# interface fa0/1 S(config-if)# switchport mode access S(config-if)# switchport port-security S(config-if)# switchport port-security S(config-if)# switchport port-security S(config-if)# switchport port-security S(config-if)# switchport port-security

maximum 2 mac-address 0000.0001.000A mac-address sticky violation shutdown

Switch t ng hoc n MAC u tin bng cach cm ln lt n PC, ri ping t PC


2007 Cisco Systems, Inc. All rights reserved. ICND1 v1.02-5

Port Security
up down

B A

S(config)# interface fa0/1 S(config-if)# switchport mode access S(config-if)# switchport port-security S(config-if)# switchport port-security maximum 1 S(config-if)# switchport port-security mac-address 0000.0001.000A S(config-if)# switchport port-security violation shutdown

default violation is shutdown


2007 Cisco Systems, Inc. All rights reserved. ICND1 v1.02-6

Port Security
up

B A

S(config)# interface fa0/1 S(config-if)# switchport mode access S(config-if)# switchport port-security S(config-if)# switchport port-security S(config-if)# switchport port-security S(config-if)# switchport port-security S(config-if)# switchport port-security

maximum 2 mac-address 0000.0001.000A mac-address 0000.0001.000B violation restrict

drop frame, phat syslog


2007 Cisco Systems, Inc. All rights reserved. ICND1 v1.02-7

Port Security
up

B A

S(config)# interface fa0/1 S(config-if)# switchport mode access S(config-if)# switchport port-security S(config-if)# switchport port-security S(config-if)# switchport port-security S(config-if)# switchport port-security S(config-if)# switchport port-security

maximum 2 mac-address 0000.0001.000A mac-address 0000.0001.000B violation protect

drop frame, no syslog


2007 Cisco Systems, Inc. All rights reserved. ICND1 v1.02-8

Recovery Port Security


down up

A B

S(config)# interface fa0/1 S(config-if)# shutdown S(config-if)# no shutdown

2007 Cisco Systems, Inc. All rights reserved.

ICND1 v1.02-9

Securing Unused Ports


down up

B A

S(config)# errdisable detect cause all S(config)# errdisable recovery cause all S(config)# errdisable recovery interval 30

2007 Cisco Systems, Inc. All rights reserved.

ICND1 v1.02-10

Verifying Port Security

SwitchX# show port-security interface f0/5 Port Security : Enabled Port Status : Secure-up Violation Mode : Shutdown Aging Time : 20 mins Aging Type : Absolute SecureStatic Address Aging : Disabled Maximum MAC Addresses : 1 Total MAC Addresses : 1 Configured MAC Addresses : 0 Sticky MAC Addresses : 0 Last Source Address : 0000.0000.0000 Security Violation Count : 0

2007 Cisco Systems, Inc. All rights reserved.

ICND1 v1.02-11

Verifying Port Security

SwitchX# show port-security address Secure Mac Address Table ----------------------------------------------------------------Vlan Mac Address Type Ports Remaining Age (mins) --------------------------------1 0008.dddd.eeee SecureConfigured Fa0/5 ----------------------------------------------------------------Total Addresses in System (excluding one mac per port) : 0 Max Addresses limit in System (excluding one mac per port) : 1024

2007 Cisco Systems, Inc. All rights reserved.

ICND1 v1.02-12

Verifying Port Security

SW1# show interface status err-disabled Port Name Status Reason Err-disabled Vlans Fa0/2 err-disabled port-security

2007 Cisco Systems, Inc. All rights reserved.

ICND1 v1.02-13

You might also like