In this video we're going to discuss port security which is used to provide a level of authentication
in an Ethernet environment in a wired ethernet environment as an example.
There's nothing stopping you simply plugging in your PC into any open port in the network.
So as an example there's nothing stopping a user connecting their PC to a port in a director's office
which then results in them having access to the director's villain.
There's also nothing stopping a user connecting a wireless access point to the network and allowing
multiple users to access the wired network through that wireless access point.
That's a major security risk.
What port security does is it looks at the source MAC address of frame's received on a port and you
can restrict the frames are allowed on a specific port to either a single MAC address that you configure
or to a limited number of MAC addresses that are dynamically learnt.
There are various options which we'll discuss.
But as an example you could say on the port that connects to the director's office only the MAC address
associated with their laptop or their PC is allowed to send frame's to the switch and therefore belong
to the directors of the land.
Or you could limit the number of MAC addresses allowed in a port as an example you could limit the number
of MAC addresses to one which would only allow a single PC to access the network through that port.
Or if you have a PC connected to an IP phone you may limit the MAC addresses to three 2 for the IP phone
and one for the PC attached to the IP phone.
That would stop a user connecting an access point or a hub to the network and allowing multiple unauthorized
devices access to the ethernet network.
Please note this is not to use any cation user.
Any question can be implemented using Ada to that one x.
This is a more basic authentication based on MAC addresses so only frames from specific MAC addresses
are allowed or a limited number of MAC addresses are permitted on a port on a switch that solves the
issue of a user connecting to a port that they are not authorized to connect to.
Stopping a user connecting a hub a wireless access point to the network and therefore allowing unauthorized
access to the network.
You can decide what happens when there's a violation of port security.
You could simply drop the frames or you could shut the port down using what's called an error or disable
state in the most secure implementation where you disable the port.
You as an administrator have to manually re-enable the port so the user would have to contact the helpdesk
as an example and explain that they no longer have access to the network.
And then you could investigate what happened and you'd be able to see if an authorized MAC address or
group of MAC addresses of tried to access the network through that port.
Port security is one of multiple security mechanisms that you can implement in a network.
Security is kind of like a castle of old as shown here.
The idea is is that you have multiple security mechanisms that in of themselves don't provide total
security but each layer of security or each mechanism adds a nother level of security.
So in this example you'd have to get across the sea to get to the castle.
Then you'd have to scale the outer wall and you still not at the core of the castle.
You'd have to climb up this hill and then scale the inner wall to be able to get to the king in the
castle as an example.
So in security you implement multiple walls or mechanisms to make it harder for a hacker to attack your
network.
This also applies to users who inadvertently or without being malicious do something that they shouldn't
on your network.
So port security isn't a catch all security mechanism.
It's just one of many and provides a basic or entry level security mechanism to your network Ethernet.
Once again has no security built into it.
A user could simply plug a laptop into your network and gain full access to the network now there's
several ways that MAC addresses can be learnt.
The first a static way you statically configure specific MAC addresses that are allowed or permitted
on a port any mac addresses that you don't specify on not allowed on the port.
The advantage with this method is that you have a lot of control but the disadvantage is that you have
to manually work out what the MAC addresses are of all your devices and then manually configure them.
You could also use dynamic learning where you specify how many MAC addresses are permitted on a port
and they are dynamically learned.
So as an example you could say that only two MAC addresses are permitted on a port and the first two
MAC addresses that are learnt are permitted any subsequent MAC addresses are not permitted you would
use this as an example to limit the MAC addresses permitted but not to which MAC addresses are permitted
so you are limiting the number of MAC addresses and not a limiting based on specific MAC addresses.
The thing to remember about Domenica learning is that when the switch is rebooted while the port goes
down the MAC addresses learnt are removed and new MAC addresses would then be permitted when the port
comes up again.
You could also specify a aging interval to allow MAC addresses to be forgotten after a period of time.
So if you had a situation where you had a hot desk or a board room you may only allow a certain number
of MAC addresses on a port but those MAC addresses can change over time.
You can also do a combination of static and dynamic learning where you explicitly permit certain MAC
addresses.
So as an example you could limit the number of MAC addresses on a port to four but only statically configured
to MAC addresses the remaining two MAC addresses can be dynamically learned.
The static at MAC addresses do not a jot but you could allow the dynamically learnt MAC addresses to
a jot stickie learning allows you to automatically add a learnt MAC address to the running configuration
of the switch.
So rather than statically configuring MAC addresses you could allow the switch to learn MAC addresses
and then add them to the configuration when you save your running configuration to start up configuration.
Those MAC addresses will be kept in nv ram and therefore won't be lost if the switch reboots.
So there are various options.
Remember port security is an initial way to implement security.
It allows you to limit the number of MAC addresses permitted on a port and it allows you to specify
which MAC addresses are permitted on a port.
You have the option of just limiting to MAC addresses on a port but not worrying what those MAC addresses
are.
They would stop a user bringing a access point or home router to work and plugging it into the network
and allowing the friends to access the network.
Or you could be strict and only allow specific MAC addresses on a port so a user can't connect to a
director's port and therefore have access to the director's view and.