Port Security in Switch Part 2

Port Security Configuration

Take a switch and connect three PC's and one switch on the switch's port Fa 0/1 - Fa 0/4 as shown below

Now on interface Fa 0/1, we will perform the following configuration

switch# interface fast ethernet 0/1
switch# switchport mode trunk
switch# switchport port-security
switch# switchport port-security maximum 1

On fa 0/1, we have assign the maximum number for devices that can be connected on this port. So if the maximum no reached past it's limit the port will get disable as shown below

Now on interface fa 0/2, we will perform the following configuration

switch# interface fast ethernet 0/2
switch# switchport mode access
switch# switchport port-security
switch# switchport port-security maximum 1
switch#  switchport port-security violation shutdown

On fa 0/2, we have assign violation rule which is shutdown. Whenever a port-security is breached ,  the violation action performs it's function .There are three types of actions for violation :

• Protect 
• Restrict
• Shutdown

Now on interface fa 0/3, we will perform the following configuration

switch# interface fast ethernet 0/3
switch# switchport mode access
switch# switchport port-security
switch# switchport port-security mac-address 0001.420C.83EA

On fa0/2, you can see that we have assigned a static MAC address but port detected another MAC address which is a clear violation and has been shutdown as shown below

 

Now on interface fa 0/4, we will perform the following configuration

switch# interface fast ethernet 0/4
switch# switchport mode access
switch# switchport port-security
switch# switchport port-security mac-address sticky
  
On fa0/4, we have configured the sticky command which will dynamically take the mac address from the first device that gets connected on that port.

Now remember to enable a port again that has been disabled, you need to manually disable the port by using the "shutdown" command and then enable it with "no shutdown" command. 

To see the port-security status of any interface, the command is "show port-security interface". The status of fa 0/1 has been shown below.

 

Port Security in Switch Part 1

Port Security

Introduction
Suppose your I.T head asks you to connect only the known list of users in a switch in your I.T so no other users from another depart comes and connect there device with your switch. That's where the concept of port security helps you to solve this problem. Through port security, inappropriate device cannot connect with your switch which makes the switch more secure. The identification of the devices are made by the device's MAC address because the switch only understands the MAC address but not the device's IP address.

Features of Port Security

The features of port security are as follows:

• The switch keeps a list of all incoming frames from all the source's MAC address .
• The switch helps you to define the maximum no of MAC address which should have access through that port.
• If the no of MAC addresses reached the configured maximum limit, it gives the detection of port security violation.
• There is a command called sticky MAC address which helps the port security to learn the MAC address of the devices dynamically so that you should not carry the burden of writing address of all devices with your hands.

This is an important note that you should keep in your mind which is "Whenever you put port security on a port of a switch, the switch will no longer any MAC address as a dynamic entry. Now we know that to see the mac address entries in a switch you use the command "show mac address" but this command will not work on ports that uses port security. There are two commands that help  you to see MAC addresses of secure ports which are as follows

• Show mac address-table secure: This command shows the mac address list of those ports that uses port security.
• Show mac address-table static: This command shows the mac address list of those ports that are statically assigned by the host.

In the next post post we will learn the configuration of port security and also the show commands that have been listed above.

Switch interface status and duplex/speed synchronization

Troubleshooting is a very important in a career of a network engineer. If a network of the company in which you are working goes down you must have the ability to perform troubleshoot and fix problems so your network quickly comes back online and the company resume it's work. In this post we will talk about troubleshooting in switches.There are many features you need to analyze on switches in which some are shown below :

• Checking Interface status and statistics
• Pattern of forwarding frames
• Synchronization of speed and duplex
• Examining port security
• Configuration of VLAN and VLAN trunking

When you use the command of show interface status in switches, The command shows two types of status which is the Line status and the Protocol status. The line status refers to the layer 1 (Physical Layer) status condition and the protocol layer gives us the layer 2 (Data Link Layer) status condition. The line and protocol status can be in an up state, down state or administratively down
(manually done by the host) state. Below are the combination status and causes made by both the status

Line Status         Protocol status         Interface                 Causes

1. up                                      up                   connected                 The interface is working
2. down                                 down                disabled                    Disabled by port security
3. up                                     down                not connected            Not expected on switch
4. down                                 down                not connected            Bad cable or wrong pinouts
5. administratively down          down                disabled                    Done by the user manually

                                                                                                              
Duplex and Speed 
We all know what is speed of a  network but most of you are not familiar with duplex .There are two types of duplex:

• Full duplex : The switch can send and receive at the same time.
• Half duplex : The switch cannot send and receive at the same time.

Now remember, the speed and duplex of the switch and the user end devices must be same. Suppose the pc is sending data at 100mbps but the switch speed is just 10 mbps. The link won't work because the speed must be the same. Same isthe condition for duplex that both the devices must have the same duplex mode.There is a command called "Auto-negotiation" which helps us to solve this problem.

In any case,if the auto-negotiation setting fails on a switch or a user end device, it then uses default settings which are

• Speed :Use the slowest supported speed (mostly 10mbps).
• Duplex: If 10 or 100 mbps, use half duplex otherwise it will use full duplex.

In the next post, we will learn about the port security which is an important part of a switch in terms of security and troubleshooting.