- [Instructor] A best approach to securing a switch
is to apply Port Security.
This is a way to limit which device can connect to a switch
on a given port.
One approach is to manually configure the MAC address
for the directly connected device.
Another approach is to automatically or allow the switch to
automatically learn the MAC address of the directly
connected network host, via the incoming frame.
And then to permanently assign that address
to the switchport.
This approach to security is often called sticky.
The switchport can also be configured for how many MAC
addresses that will permanently assign to the port.
And can also be configured to shut down
if there is a security violation.
I'm now going to demonstrate how to configure port security
on the west switch.
I'm going to click on the west switch,
that brings up the command line interface.
I'm going to go ahead and type configure from the terminal.
I'm then going to go into interface fastEthernet 0/2
security is an interface specific command line,
and we're going to secure this port for access to host one.
The command then is switchport mode access.
This is our access port, we have a single host attached.
Then the next command would be switchport port-security
that enables support security on fa0/2.
I'm now going to show you how to manually set the MAC
address for this switchport.
The command is switchport port-security mac address,
and then I type the mac address of host one.
And that is 00e0.a34a.443b.
I hit Enter, that permanently assigns the MAC address of the
host to that port, I do a Control Z, I do a show run.
You can see that that MAC address is the only address that
this port will accept for traffic.
Alternatively, I can configure this port to automatically
learn the MAC address of the directly connected host.
Again, I go into config t, before I do that,
I'm going to have to remove the prior command and I'll show
you how to do that as well.
Int fastEthernet 0/2, I go ahead and recall my command
with the up arrow, I can use a Control A
to get to the front of the command, type no, hit Enter,
and that removes that command from the fastEthernet port.
I can then change to a dynamic mode,
which is switchport port-security mac-address.
And I do a question mark, you can see sticky,
is the other option so I'm going to go ahead and type sticky.
I'm also going to go ahead and the switchport port-security.
Again, question mark so that the maximum number
of dynamically learned addresses is one.
So maximum of one, and then I'm going to use the other command,
the violation command, switchport port-security violation.
Again, question mark, I'm going to use the shutdown command,
so that the port will automatically shut down if the device
with a MAC address, other than the addresses learned,
tries to connect to the network through that port.
Control Z, I'm going to do a show run.
You can see that this port is now configured
to automatically learn that MAC address,
and to automatically shut down if the violation occurs.
I'm going to go ahead and allow it to learn the address,
I'm going to click on host one.
And I go to the desktop, to the command prompt,
I'm going to create some traffic by issuing a ping
to the 192.168.1.1 device that's the router.
You can see I get a reply, that allows the switch to learn
the MAC address of the west host because the traffic is now
passing through it, on the way to the router.
I go back to the switch.
I want to show you a couple of very useful commands.
The first command is the show port security address command.
Show port-security address, you can see that
the switch has learned the MAC address of host one,
and that is stuck to this port, and the port is associated
with the fastEthernet 0/2.
The other command that is very useful
is the show port-security interface fastEthernet 0/2.
This displays all of the port security settings
for this interface.
You see port security is enabled.
Port status is up.
The violation mode is to shut down this port
if MAC addresses sense that is not associated with a port,
and finally, you can see that the maximum number
of addresses is one, and that the learned MAC address
at the bottom is that address from the host one.