In the previous video we configure port security on gigabit 00 by making the port an access port and
then enabling port security.
MAC address is dynamically learnt.
So this MAC address was dynamically learnt on port to Gigabit 00 and hence Shope port security shows
us that the address permitted on that port.
Is this MAC address.
It was done I meekly learnt and has been added to the database of permitted MAC addresses on the port
only one MAC address is allowed
on gigabit 00.
So Max schem accuracy's is one if a violation does take place the security action is to shut the port
down.
Now let's configure MAC addresses statically So let's configure port security on gigabit.
0 1 but do it manually.
So I'm going to use the commotions switch Port.
Port security specify a maximum.
The default is 1.
So I'll say one here.
And what you'll notice is the output is not shown because that is a default command on the interface.
But what we'll do now is type switch port Port Security MAC address and what I'll do is explicitly specify
the MAC address that's allowed.
And just to prove the point or specify a different MAC address of let's say three.
Now at the moment the MAC address on this router acting as our PC is thus.
So it's a different MAC address the PC can still ping rather one because we haven't explicitly enabled
port security yet so we've configured what the MAC address is.
We've configured the maximum MAC addresses allowed.
I'll specify the action to take if there's a violation
notice we have protect restrict and shut down the default as we've seen is shut down now protect drops
packets with unknown source MAC addresses until you remove a sufficient number of secure MAC addresses
to drop below the maximum value.
In other words we are dropping packets from unknown source MAC addresses.
But there's no logging at the moment only allowing one MAC address.
But as an example if you had specified a maximum MAC address of three and a fourth a device try to send
traffic that to devices traffic would be dropped restrict drops packets with unknown source MAC addresses
until you remove a sufficient number of secure MAC addresses to drop below the maximum value.
So that's very much the same as protect.
But in addition it causes the security violation counted to increment.
In other words there's going to be the generation of log messages and counter's will increment shutdown
is the default which we've already seen.
And that puts the port into a disable mode and Saens and SMP trap notification if SMP is configured.
So I'll continue to use shutdown so that we can see the output configuration looks as follows.
Remember the MAC address of this device is a different MAC address.
It's thus.
But we are only permitting this MAC address but because we haven't globally enabled port security port
security is not active.
So we can use the commode to show port security at the moment.
Port security is enabled on gigabit 00 but not on gigabit 0 1.
We can also use the command do show interface status at the moment both gigabit 0 0 and 0 1.
Our connected support hasn't been shut down because of port security.
But now when we type which port Port Security we are actually enabling port security.
And once again we need to have this configured as an access port Conti's TTP to do show run interface
gigabit 0 1.
And while I was doing that notice we received a port security violation message.
We were told that there was an issue with this mac address ending in two on gigabit.
0 1 we have only permitted the MAC address ending in three maximum MAC addresses that would be permitted.
One only one MAC addresses permitted in this case.
When we look at the Comeau and do show interface status we can see that the port was disabled.
So show interface status is a command that shows us the status of the ports we can see this is connected
but this port has a disabled so show port security once again shows us once again that gigabit is 0
0 and 0 1 have a security action of shutdown.
But the only port that's currently shut down is port 0 1.
So show interface status shows us that this port is still connected.
The supporters area disabled and now this host can ping right of one because the port porters are disabled
show port security interface gigabit to 0 1.
We can see that port security is enabled on this port.
It's currently shut down because of the mode being shut down.
This is the last MAC address that violated the security policy on that interface.
So on brought it to if we change the MAC address to the the MAC address expected by the switch it still
won't be able to ping because of the violation that took place.
So we need to go into the port and shut it down and then no shut it.
And once that's done and the switch learns the correct MAC address
the device should be able to ping.
So at the moment the MAC address hasn't been learnt
just waiting for the interface to come up.
So show interface status.
Let's see what's going on interfaces connected.
And now the ping succeeds.
I was just too impatient and I needed to wait for spending tree and other protocols to sort themselves
out but show port security interface gigabit 0 1.
We can see port security is enabled violation mode shut down at the moment the port status is secure
and the interfaces up last MAC address that was seen was this on that port.
No security violations occurred.
Maximum MAC address is once again allowed as one total MAC address is seen as one.
One MAC address is being configured because we manually configured the MAC address on the switch.
So if I save this configuration and the switch reboot the MAC address is stored in the saved configuration.
So that's different to what we have on gigabit 00 here.
When the switch reboots it would simply learn the source MAC address from a frame received.
So the first device that connects will have its MAC address added to the database to show port security
address as an example shows us the two addresses.
This one was statically configured.
This one was dynamically learnt.
So the MAC address on the interface was configured.
This was done chemically learnt.
Now the example on the right is where you explicitly allowing a specific MAC address onto the network.
The example on the left is where you are restricting the number of MAC addresses permitted on a port
on the left.
You would stop a user connecting a hub as an example to the network and connecting multiple devices
to the port whereas the example on the right is where we are limiting traffic to a specific MAC address.
The problem with this method is we are having to work out what the MAC addresses of the devices are
and then manually configuring those MAC addresses.
So let's look at another way of doing it.