#CCNA

CISCO port-security configuration

by Amar 0

Port security can be used to restrict devices communicating through the interface by limiting the MAC address on the interface. When you assign a SECURE MAC address to the port, the device does not forward/process frames that fall outside the group of secure mac addresses, resulting in dedicated bandwidth for the devices which are allowed to communicate through the port.

Port security guidelines and restrictions

  • Port security supports private vlans (PVLAN)
  • Port security supports dot1q tunnels
  • Port security does not support EtherChannel
  • Port security does not support port analyzer (SPAN)
  • Port security supports trunk ports only with following configuration –
    switchport trunk encapsulation
    switchport mode trunk
    switchport nonegotiate

Secure MAC address can be configured in the following ways :

  • Configure all MAC address using the switchport port-security mac-address mac_address command.
  • Allow the port to dynamically learn the MAC address of the connected devices.
  • Configure few specific MAC addresses and allow the port to dynamically learn rest
  • Configure sticky MAC address which are stored in the address-table, and added to the configuration file. If the switches needs to be restarted, the interface does not need to re-learn the MAC addresses as they are already in the configuration file.

Security Violation :
A security violation occurs when a device who is not part of secure mac address tries to communicate through the secure port.

  • If violation is occurs, switch sends a snmp trap
  • Violation mode action configured is executed

Violation Actions :

  • Shutdown – (default) Switch will shutdown the interface (err-disabled) and no frames are forwarded thereafter.
  • Protect – Switch allows only secure frames and blocks violating frames
  • Restrict – Switch restricts the data, sends a snmp trap and increases the SecurityViolation counter

To enable port security on a trunk, perform this task:

 
 

Command

Purpose

Step 1

Router(config)# interface type1  slot/port

Selects the LAN port to configure.

Step 2

Router(config-if)# switchport

Configures the port as a Layer 2 port.

Step 3

Router(config-if)# switchport trunk encapsulation {isl | dot1q}

Configures the encapsulation, which configures the Layer 2 switching port as either an ISL or 802.1Q trunk.

Step 4

Router(config-if)# switchport mode trunk

Configures the port to trunk unconditionally.

Step 5

Router(config-if)# switchport nonegotiate

Configures the trunk not to use DTP.

Step 6

Router(config-if)# switchport port-security

Enables port security on the trunk.

Step 7

Router(config-if)# do show port-securityinterface type1 slot/port | include Port Security

Verifies the configuration.

 

Reference : Cisco-port-security-docs