- It's usually not a good thing to have your switches
available for anyone to just plug in and play around.
I mean we worry about wireless security,
so why wouldn't we demand switch security just as much?
But just how do we actually prevent someone
from simply plug in a host into one of our switch ports?
Or worse, adding their hub switcher access point
into the Ethernet jack in their office.
By default, MAC addresses will just dynamically
appear in your MAC database.
You can stop them in their tracks by using port security.
This graphic shows two hosts connected to the
single switch port FastEthernet 0/3
via either a hub or access point.
Port FastEthernet 0/3 is configured to observe
and allow only certain MAC addresses to associate
with this specific port.
So in this example, Host A is denied access,
but Host B is allowed to associate with the port.
By using port security, you can limit the number
of MAC addresses that are assigned to a port.
You can set static MAC addresses
and here's my favorite part,
set penalties for users who abuse your policy.
Personally, I like to have the port shut down
when the security policy is violated.
I like to make the abusers bring me a memo
from their boss explaining why they violated
the security policy, which brings with it
a certain poetic justice.
And I'll also require the same explanation before
I'll enable their port again.
Things like this, really seem to help
people remember to behave.
Even with policies in place, you still need to balance
your particular security needs with the time
that implementing and managing them
will realistically require.
There are ways to secure things nicely
without being totally overwhelmed with a massive
amount of administrative overhead.
A good place to start is to shut down unused ports
or assign them to an unused VLAN.
All ports on switches are enabled by default,
so you need to make sure there's no access
to unused switch ports.