Switch port security filters incoming frames based on the source MAC address. Simple enough, right? Well, this long-time switch security feature has more than a few twists. Chapter 6 of the CCNA 200-301 Cert Guide Volume 2 covers Port Security – use this post to get a little help to recreate the book’s examples from that chapter. Good learning!
The big idea is pretty simple: Repeat the Examples in the Official Cert Guide as part of your lab practice for CCNA using Packet Tracer.
The details require some reading. To get your head around what kind of content is here in the blog for these labs, read:
Chapter Intro: A brief description of the topics in that chapter of the book.
Download Link: Links to a ZIP; the ZIP holds all the .PKT files for this chapter.
Table of PKT files, by Example: A table that lists each example in the chapter, with the files supplied for each. Also lists a note about whether the PKT topology matches the book example exactly or not.
Tips: When we build the files, we come across items that we think might confuse you when trying the examples with PT. We write those notes in this section!
Chapter 6 of the CCNA 200-301 Official Cert Guide, Volume 2 discusses Cisco switch port security, from concepts, configuration, to verification. Once enabled on an interface, port security adds logic for each incoming frame, comparing the source MAC address of the frame versus a table and a few other logic steps. The result can be to allow the frame to continue as normal, but the other results can be a variety of steps to prevent the traffic, from simply discarding that frame to both discarding the frame and disabling the interface.
Port security allows us to configure several settings to match incoming frames, including:
Packet Tracer has solid support for the port security feature, so join in, configure the features, and experiment with the verification commands.
When building the content for this post, we review the examples in the book and decide whether it makes sense to supply a Packet Tracer (.pkt) file to match the example. If we choose to support an example by supplying a matching .pkt file, the .pkt file includes a topology that matches the example as much as possible. It also includes the device configurations as they should exist at the beginning of the example.
In some cases, the .pkt file shows two instances of the lab topology – one above and one below. We include two such topologies when the book example includes configuration commands, for these purposes:
|
Example |
.PKT Includes Initial State of Example? | .PKT Also Includes Ending State of Example? | Exact Match of Interface IDs? |
| 6-1 | Yes | Yes | Yes |
| 6-2 | Yes | No | Yes |
| 6-3 | Yes | No | Yes |
| 6-4 | Use 6-3 | No | Yes |
| 6-5 | Yes | No | Yes |
| 6-6 | Use 6-5 | No | N/A |
| 6-7 | Yes | No | N/A |
| 6-8 | Yes | No | N/A |
Note that the initial state in this .pkt does not include the Port Security configuration shown in the example, with the ending state of the .pkt including the configuration in the example.
Also, the book does not detail the IP addresses of the hosts in the related figure, but the .pkt file includes pre-configured IP addresses as follows, for easier testing:
Note: This example is based on the configuration added in Example 6-1.
Also, note that in Packet Tracer, the show running-config interface f0/2 does not work. The command would work on real gear. Use instead the show running-config command.
Note: This example is based on the configuration added in Example 6-1.
The output shown in the example matches a particular scenario when testing. To re-create that scenario, so that the output best matches the book’s output:
PT does not support several of the commands shown in the example. However, you can use these commands to find most of the same output, although you will have to ignore unrelated output:
Note that Example 6-5 and onward in this chapter do not continue the same scenario as shown in Examples 6-1, 6-2, 6-3, and 6-4.
IP reference:
To re-create the output in the example:
Although this example is based on the same .pkt file as Example 6-5, re-open the .pkt file to begin your experiments with Example 6-6 to reset the beginning state.
IP address reference:
Suggestion: Make the switch SW1 CLI visible for the entire experiment so you can see when the switch disables the port.
To re-create the output in the example:
The show interface f0/13 status command does not work in PKT. Use the show interface f0/13 command instead.
To re-create the output in the example:
To re-create the output in the example:
Repeat the above steps to confirm the counter keeps increasing.
Note: PT does not issue log messages in reaction to port security events, while real Cisco switches issue the messages as those shown in the example.
What are the passwords to enable mode passwords on the devices in your packet tracer labs?
Here is the link to the overview of the Labs
https://blog.certskills.com/packet-tracer-labs/
All passwords are “cisco”