How to Configure Port-Security on Cisco Switch for Enhanced Network Security .pptx
Download as PPTX, PDF0 likes109 views
Switch port security can be configured to restrict access to ports by limiting the number of MAC addresses and enforcing violations. The steps are: 1. Set the interface mode to access and enable port security. 2. Set the maximum secure MAC addresses and violation mode which can be protect, restrict, or shutdown. 3. Configure the rate limit for invalid source MAC addresses and specify allowed secure MAC addresses.
How to Configure Port-Security on Cisco Switch for Enhanced Network Security .pptx
- 1. 192.168.20.0/30 .1 .2 Restrict Switch Port Security Shutdown | Restrict | Protect
- 2. Switchport security-part-01 Violation: shutdown Step 1: Enter interface configuration mode and input the physical interface to configure. We will be using FastEthernet 0/2 as an example. Switch(config)# interface FastEthernet 0/2 Step 2: Set the interface mode to access. The default mode, which is dynamic desirable, cannot be configured to be a secured port. Switch(config-if)# switchport mode access Step 3: Enable port security on the interface. Switch(config-if)# switchport port-security Step 4: Set the maximum number of secure MAC addresses for the interface, which ranges from 1 to 3072, wherein the default value is 1. Switch(config-if)# switchport port-security maximum {1-3072}
- 3. Switch port Action During the Port security Violation Protect Restrict Shutdown Discard Offending Traffic Yes Yes Yes Sends log and SNMP message No Yes Yes Disable the interface by putting it in an err-disabled state, discarding all No No Yes Step 5: Configure the violation mode on the port. Actions that shall be taken when a security violation is detected. Refer to the table below for the actions to be taken. Switch(config-if)# switchport port-security violation {protect| restrict | shutdown} NOTE: When a secure port is in an error-disabled state, you can bring it out of the state by issuing the command ‘errdisable recovery cause psecure-violation’ at the global configuration mode, or you can manually reenable it by entering the ‘shutdown’ and ‘no shutdown’ commands.
- 4. Step 6: Set the rate limit for bad packets. Switch(config-if)# switchport port-security limit rate invalid-source-mac Step 7: Input the identified secure MAC addresses for the interface. You can use this command to limit the maximum number of secure MAC addresses. If in case, you configure fewer secure MAC addresses than the maximum, then the remaining MAC addresses are dynamically learned. Switch(config-if)# switchport port-security mac-address {mac_address} Step 8: Verify your configuration by the following commands below. Switch# show port-security address interface FastEthernet 2/1 Switch# show port-security address