What is cisco port security? How to secure switches ports? | What are the violations of port security? | How to configure?

 As we already know switches are very important network devices and with the help of switches we connect and maintain communication channels between various devices. we also know ethernet ports are present on our switches and with these ports, we connect our devices like routers computers, and other devices. switches identify the devices by their MAC addresses and provide the services. the important thing is we need to secure these ethernet ports so that authorized users are able to connect network securely. 

here we can use the security feature of Cisco IOS Port-security to block the ethernet, fast ethernet, or Gig ports when the MAC address is different from the specified MAC on the port. we can use port security to filter traffic that is destined to or received from a specific host that is based on the host MAC address. These security features only be configured on access ports and by default this feature is disabled.  

before we start our lab and come to the direct point, what I always do but before we need to understand these points.

• Aging 
• mac-address
• maximum
• violation

Aging is when we configure the maximum number of MAC addresses on the particular port, we can also configure aging with the help of aging we specify how long the address on the port is secure,

 once the time is expired, the MAC address on that port will be insecure, by default all addresses on a port are secured permanently. <1-1440> Aging time in minutes. Enter a value between 1 and 1440.

MAC address_ when we configure the specific MAC address in the port security command, only that device will be authorized by the switch to connect through the available port. this is also called a static mac address.  

from the above output, we can see after the? mark. now have (H.H.H means configure static MAC address) and the second mode is (sticky) let's take a look at sticky.

Sticky before we understand what is sticky mode first, we must know, we have two configuration options for example 

Switch(config-if)#switchport port-security mac-address sticky 0000.0C39.6AEC

                                                            {AND}

Switch(config-if)#switchport port-security mac-address sticky

whenever we enable sticky learning on an interface, the interface converts all the dynamic secure MAC addresses, and also those that were dynamically learned before sticky learning was enabled, to sticky secure MAC addresses and adds all sticky secure MAC addresses to the running configuration. all newly on-boarded clients are considered sticky MACs.

now we know that the switch can learn MAC addresses on a secure port in one of three ways. 

1. Manually the admin can manually configure a static MAC address. using the command

switchport port-security mac-address 0000.0C39.6AEC

2. Dynamically when we configure the command switchport port-security, whatever the current source MAC address on that port device will be secured but not added in running-config.  if we reboot the switch the port has to re-learn the MAC address. 

switchport port-security 

3. Dynamically-Sticky the admin can enable the switch to learn MAC address dynamically and stick them in running-config. 

switchport port-security mac-address sticky 

Maximum as per our requirements we can increase the limit of the number of hosts which is associated with the interface. by default, only 1 MAC address is allowed by the cisco switch on a single port. if other devices try to connect using this port our switch shutdown the port automatically. we can set this limit from 1 to 132. the maximum number is 132.  

Now we have the last mode violation

Violation_ when the MAC address of a connected device to a port is different from the list of secure addresses we are given on the interface, then a port violation occurs and the port enters the error-disable state. In violation, we have three modes. as you can see in the picture below.

Protect_ under the Protect mode the data packets from the configured MAC addresses are only transferred within the network. this mode is the least secure of the security violation mode. the port dropped the packets with unknown MAC addresses until you remove a sufficient number of MAC addresses. no syslog message is sent.   

Restrict_ under the restrict mode if the security violation occurs, all the data transfer is blocked and packets are dropped. also, Syslog messages are generated simultaneously, 

Shutdown_ under the shutdown mode if the violation occurs on port security enable the port. the port changed to an error-disable state. this mode is enabled by default. 

{if you like this post, please take a look at our YouTube program}

https://youtu.be/D0t29ZdO09I

What is PVST PVST+ and RPVST+ Spanning tree? How to configure PVST?

  

Per VLAN Spanning tree (PVST) is cisco's proprietary version of STP which delivers more flexibility than the common spanning tree version. PVST works on a separate instance of STP for each VLAN. In normal STP, CST (Common Spanning Tree), only one instance can be used for the network. There are no specific instances per VLAN. This allows the STP on each VLAN to be configured independently and offers better load balancing and tuning according to the conditions. 

but as we know PVST is a cisco proprietary and because of its proprietary nature, Per VLAN Spanning tree (PVST) requires the use of a cisco inter-switch link (ISL) trunk but in coexist network where CST is working, and we configure PVST there will be problem occurs both require different trunking methods and the problem remains BPDUs are never exchanged between these types of STP. 

the solution is Per-VLAN spanning tree plus (PVST+) it's also the cisco proprietary version of STP and allows the device to interoperate with both PVST and CST. PVST+ act as a translator between a group of CST switches and groups of PVST switches. PVST+ creates an instance for each VLAN and in each instance, a different STP process occurs, a different Root bridge is selected, different port roles are used, etc.

Rapid Per VLAN Spanning Tree Plus (RPVST+) it's a Cisco proprietary STP version. Again, it has an instance for each VLAN and each VLAN has a separate STP process just like PVST but RPVST+ has a faster convergence advantage if we compare it with PVST+.

 

Let's see the configuration for a better understanding:

Topology:

Goal:

• configure the topology as per the diagram.
• configure VLANs 10,20,30 and 40 on all the switches.
• configure TRUNK between switches 
• Allowed all VLANs on all the switches
• configure PVST on all switches 
• configure Root bridge on switch 1 for VLAN 10
• configure Root bridge on switch 2 for VLAN 20 
• configure Root bridge on switch 3 for VLAN 30
• configure Root bridge on switch 4 for VLAN 40 
• verify the configuration 

SWITCH-1(config-vlan)#VLAN 10

SWITCH-1(config-vlan)#VLAN 20

SWITCH-1(config-vlan)#VLAN 30

SWITCH-1(config-vlan)#VLAN 40 

SWITCH-2(config)#VLAN 10

SWITCH-2(config-vlan)#VLAN 20 

SWITCH-2(config-vlan)#VLAN 30

SWITCH-2(config-vlan)#VLAN 40

SWITCH-3(config)#VLAN 10

SWITCH-3(config-vlan)#VLAN 20 

SWITCH-3(config-vlan)#VLAN 30

SWITCH-3(config-vlan)#VLAN 40

SWITCH-4(config)#VLAN 10

SWITCH-4(config-vlan)#VLAN 20 

SWITCH-4(config-vlan)#VLAN 30

SWITCH-4(config-vlan)#VLAN 40

SWITCH-1(config)#interface range fastEthernet 0/1-2

SWITCH-1(config-if-range)#switchport mode trunk

SWITCH-1(config-if-range)#exit

%LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/1, changed state to down

%LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/1, changed state to up

SWITCH-2(config)#interface range fastEthernet 0/1-2

SWITCH-2(config-if-range)#switchport mode trunk

%LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/2, changed state to down

%LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/2, changed state to up

SWITCH-3(config)#interface range fastEthernet 0/1-2

SWITCH-3(config-if-range)#switchport mode trunk

%LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/1, changed state to down

%LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/1, changed state to up

SWITCH-4(config)#interface range fastEthernet 0/1-2

SWITCH-4(config-if-range)#switchport mode trunk

%LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/1, changed state to down

%LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/1, changed state to up

SWITCH-1(config)#interface range fastEthernet 0/1-2

SWITCH-1(config-if-range)#switchport trunk allowed vlan 1-40 

SWITCH-1(config-if-range)#exit

SWITCH-2(config)#interface range fastEthernet 0/1-2

SWITCH-2(config-if-range)#switchport trunk allowed vlan 1-40 

SWITCH-2(config-if-range)#exit

SWITCH-3(config)#interface range fastEthernet 0/1-2

SWITCH-3(config-if-range)#switchport trunk allowed vlan 1-40 

SWITCH-3(config-if-range)#exit

SWITCH-4(config)#interface range fastEthernet 0/1-2

SWITCH-4(config-if-range)#switchport trunk allowed vlan 1-40 

SWITCH-4(config-if-range)#exit

SWITCH-1(config)#spanning-tree ?

  mode      Spanning tree operating mode

  portfast  Spanning tree portfast options

  vlan      VLAN Switch Spanning Tree

SWITCH-1(config)#spanning-tree  mode ?

  pvst        Per-Vlan spanning tree mode

  rapid-pvst  Per-Vlan rapid spanning tree mode

SWITCH-1(config)#spanning-tree  mode pvst

SWITCH-2(config)#spanning-tree mode pvst

SWITCH-3(config)#spanning-tree mode pvst

SWITCH-4(config)#spanning-tree mode pvst

SWITCH-1(config)#spanning-tree vlan 10 root primary 

SWITCH 1 VLAN 10

SWITCH-2(config)#spanning-tree vlan 20 root primary

SWITCH 2 VLAN 20

 

SWITCH-3(config)#spanning-tree vlan 30 root primary 

SWITCH 3 VLAN 30

SWITCH-4(config)#spanning-tree vlan 40 root primary 

SWITCH 4 VLAN 40