- [Instructor] Now that we have the fundamentals
of port security down, let's take a look
by running out to switch one of our network and logging in.
And there are some show commands with port security
we're gonna look at, but I'm gonna run right out
and start configuring the ports,
'cause this is done now, as you know, on an interface level.
So I'm gonna choose my interfaces.
I can do this on one port, but typically
we'll use a range, and so the command is range.
So I can configure multiple ports at once by saying
interface range f0, the starting port,
in this case, one, and well do through 12.
And now I'm configuring 12 ports
at once, which is kinda nice.
Now, so the command to enable port security is this:
switchport port-security and enter.
If I turn this on, I'm turning on the defaults.
But it gives me and error because my ports
on a Cisco switch, a layer two
access switch, are dynamic desirable.
They desire to trunk, so if they see another
Cisco switch using something called dynamic trunk protocol,
across the connection to another switch,
they're going to trunk if they are two Cisco routers.
So in this case here, the first thing I have to do
is switchport mode access, right?
Very typical command here when you're doing port security.
You wanna only put it on access ports,
so I'm gonna make it an access port.
Now, I can come back here and enable port security.
Now I can walk away, go to lunch, whatever.
I have port security on my ports.
Now, however, let's take a look at this again, I'm gonna say
switchport port-security ?
And these are the variables and the options.
Switchport port-security, we use the commands
mac address, maximum and violation, so,
in this case here, the maximum allowed of mac addresses,
by default with the switchport port security enter,
under interface mode, says you have a maximum
of one mac address that's allowed.
And the violation is shutdown, that's the defaults.
So if more than one mac address comes into a port
at the same time, it'll shut down the port
and put it into error disabled.
So, this case here, the first thing I wanna do is,
I wanna do maximum, and let's do a question mark
and see that we can do 6,000 mac addresses
on a port, that's more than sufficient.
Switchport port-security max security, I'll set it to two.
And then the other thing is,
switchport port-security violation
and let's tall about the three violations
that we've discussed already,
protect, restricts, and shutdown.
You should know already which two of these
provide an SNMP trap when a violation occurs.
And that answer is restrict and shutdown.
Protect is great, and I'm gonna use this one.
I don't like to hear from users.
So what this does is protect it, doesn't tell me about it.
So, if someone hooks something up
and adds another mac address, the frames
are dropped, and we're protected.
And without administrative overhead, that part I like.
The other part I wanna do is
switchport port-security mac address,
and let me see a couple things, we can type in the
mac address, or you can use what's called the sticky,
and this is doing static mac addressing dynamically.
So whichever, based on how many maximum mac addresses
you are allowed, which is two in this case,
are gonna be put into the running config.
If we wanna change them, we have to go into
the running config and take them out.
So the other one, switchport port-security,
and we've got mac address, got maximum, and violation.
So at this point here, we should be
good to go, let's take a look.
So I'm gonna do a show run, this is a really
great way to see your config here.
And just look at the port one,
and we can see, I have an access port.
I've enabled port security, and if I just had
those two commands, it'd be maximum one, violation shutdown.
Notice I set it to maximum two, violation protect,
mac-address sticky, and it already found an address.
OK, now a couple more commands here, show port security,
and this is gonna show me my mac address security count,
that I can have two, how many there are already.
You can see some of them already have one.
If I had a violation, and my security action.
The last command we're gonna take a look at,
show port-security interface,
I'm just picking interface in this case.
The first thing you wanna look at here, ceasing objective,
port security enabled, that's because I went to the
interface and said switchport port security enter.
After I made it an access port of course, then I enabled it.
This would say disabled if I didn't do that.
Port status is secure up, you would always say that
under protect or restrict, only if I had
shutdown violation mode would it go into error disabled.
And then also we can see maximum mac addresses allowed,
and two, there's one been configured,
and we have one sticky mac address,
and it's showing us that.
That my friends, is how easy it is
to do port security, and also how to verify it.