So let's configure and test port security in this example I've got to Jinnah's three running Iowas relate
to that SAO switch in the topology and then I'll go to Cisco Iowas router.
It's a 37 25 router image which I'm using as the PCs in the topology so Router one will actis PC one
and router two will act as PC two will configure MAC addresses on the routers and then change them to
prove that port security works.
MAC addresses with vendor code 0 0 to 3:33 belong to Cisco Systems.
So we'll use this MAC address range so that we can see the output and why shock and Krait easy to read
MAC addresses in the lab.
The Rawdon's switch have booted up with no configuration
selfmade no configuration changes on these devices.
Let's start off by naming this device which one rod of one has already configured and says router to
based on the default configuration in G and has three but the switch has no configuration.
So at the moment if we top show port security you'll notice that there's no output.
Because port security is not currently enabled shows a MAC Address table.
Shows that no MAC addresses have been learnt.
Rather one let's configure first Ethan it is 0 0 with MAC address 0 0 T-3 3 3 0 0 TRIPLE 0 0 1 and 0
no shut that port will do something similar on route to which just make this two rather than 1 and No
shut to the port show MAC Address table shows us that the switch has learnt both these MAC addresses.
So Rotto one is available on gigabit 00 router 2 is available on gigabit.
0 1 both addresses were linked dynamically.
In other words we didn't statically configured these MAC addresses.
They have been dynamically learnt by the switch.
So port security still shows us that port security hasn't been enabled.
We have no output so going on to Gigabit is 00.
Let's try and enable port security.
Notice the command is rejected.
And that's because we're running dynamic trunking protocol or DTP on this port.
We haven't statically configured this port as an access port or as a trunk port.
So let's top switch port mode access and will enable port security again.
The command is now accepted so show port security shows us that the port is gigabit to 0 0 the maximum
secure addresses allowed on the port is one by default only a maximum of one MAC addresses allowed on
a port security port.
How many MAC addresses have currently been learnt on his one.
How many security violations have occurred.
Zero.
And what security action will be taken if there's a violation.
The port will be shut down.
In other words it will be disabled.
We'll look at some of the other options in a moment but let's see what happens.
Show port security.
Let's look at some options.
Address
so he has the secure MAC Address table on villaine one this MAC address has been lent.
The type is secure dynamic.
We dynamically learnt about the address.
The port is is 0 0 the remaining age is a hyphen you can determine how long a MAC address that is learnt
is remembered before it's aged out on a port.
Now notice this example is not restricting this port to specific MAC addresses.
It's limiting the port to one MAC address.
We didn't statically configure the port.
So show run interface gigabit 00 shows us that we enabled port security and that's all we did.
We didn't statically configure a MAC address but if we change the MAC address on the port to let's say
three let's see what happens soon as the port came up.
We get an error disable message port security violation error detected on gigabit is 0 0 0.
The port is now being put into a disabled state the security violation occurred caused by this MAC address
notice ending in three on port gigabit 0 00 the line protocol has gone down.
So show interface.
Gigabit 0 0
there's the chemo and shows us that the port is down down.
And the reason for that is irreducible disable the port was a disabled port has gone down
this router and let's give it an IP address will not be able to send traffic to this device.
Sarada to acting as PTT because the port is down.
Show port security.
Please note this is not the status of the port.
This is the action that's taken when there's a violation.
So port security interface gigabit to 0 0 shows us that port security is enabled in the port.
The status is secure.
Shut down the violation mode is shut down.
This is the last MAC address that was seen on the port.
Only one MAC addresses allowed the violation count is one.
And that's because the MAC address that's allowed in that port which is not shown here because the port
has gone down.
I'll just scroll up to show you the output was the MAC address and we've changed the MAC address so
ending in triple 0 1 is the MAC address that's permitted.
But this is the last MAC address that was seen that caused a violation.
So let's change the MAC address back to one.
And on the side you go on to the port and shut it down.
And then wait for that to go down and then no shut it show port.
You can see that show port security before Precentor notice the porters come up supporters come up schematic
MAC addresses one at the moment it hasn't to to MAC address.
Let's do a ping to Rhonda
as you can see now it's now learnt a MAC address.
So now the pings succeed.
Sure.
Port security shows us that the max MAC address a lot is one current addresses one.
So one has been learnt.
Let's look at the interface again again of its 0 0 at the moment there is no violation.
The port status is secure up
the violation mode is to shut the port down.
But currently the port is up scrolling back up
previously noticed it was secure shut down based on the violation mode of shutdown.
But now it's secure up because the correct MAC address is being learnt which is the MAC address.
So notice here the first MAC address that was received was added to the list of permitted MAC addresses.
It was dynamically learnt.
So you would have to ensure that the right MAC address is received on the port.
If you reboot the switch that information is lost.
So the first host that's connected to that port will be permitted.
And that may not be what you want.
You may want to explicitly permit only certain MAC addresses associated with certain machines.
So let's have a look at that.