- [Instructor] Layer two security doesn't have,
a one size fits all solution,
there isn't an easy button for it.
Rather, it's a layering of multiple techniques
to achieve as much protection as is required.
I'll start by discussing a feature known as Port Security.
In essence, it limits the number of MAC addresses
and even which MAC addresses are allowed
to send inbound packets on a switch port.
Limiting the number of MAC addresses,
can prevent attacks like DHCP starvation,
where tens or hundreds of MACs,
will show up on a single interface.
When enabled on a port by default,
only a single MAC address will be learned,
incoming on that port.
And the logic is first come first served.
This means if you have multiple MAC addresses,
leaving off this port, whoever sends a packet first wins.
The default violation mode is to shut down the port,
if additional MACs arrive.
I always adjust this behavior as seen below.
While port security can be applied to a trunk port,
I wouldn't recommend it.
It's usually best to add protection
to standard access ports only.
Once in interface configuration mode,
the port security command is entered.
fig t, interface fa0/1.
Now, switchport port-security.
This enables port security with default settings.
Having said that I never leave it default
as it will always cause issues.
I always increase the number of allowed MAC addresses
to five or more with switchport port-security, maximum 5.
Remember, if a port has a phone and data device,
that's two MAC addresses right there.
I almost always also use switchport,
port-security violation restrict.
This will drop all frames from any unauthorized MACs
and increment the security violation count.
The protection action does the same as restrict,
but doesn't increment the security violation count.
Remember that shutdown action is the default.
As MACs are learned, they won't timeout.
So if a MAC address is learned on a port,
it will still associated with that port,
until the switch is rebooted.
The aging command can set a timeout for the entries,
switchport, port-security, aging tim 10.
This sets the aging time to 10 minutes,
after which entries will timeout and be relearned.
There are more options like sticky addresses.
This is configured under interface configuration mode also.
Interface fa0/2 switchport port-security mac-address sticky.
Sticky addresses can be manually configured
but are not recommended.
Rather they should be learned dynamically,
when a sticky addresses learned, it's automatically added
to the running configuration for that port.
If the switch reboots now, it will relearn everything again.
If the sticky commands in a learning config needs
to be saved permanently.
The admin can issue a Copy-Run-Start.
MAC addresses can be statically configured with,
interface fa0/3, switchport, port-security,
mac-address 0000.0000.0001.
If I'm using the default learning of one address,
then port three here will only allow,
the single static address that I entered.
If there are more allowed,
the static address will occupy one of those entries.
Once everything is configured,
verification can be done with a show run interface fa0/1
to see which config commands I've put on the interface.
Additional info can also be seen with,
show port-security interface fa0/1.
It shows the port current status,
what modes it's configured for,
the number of MACs currently learned,
and how many MACs can be learned.
Port security is a great first step,
in protecting user ports.