Answer: Basic Port Security 2

No fluff – just straightforward config. First do the lab as listed in the earlier post, that is, try it for yourself. (For you test takers, the point is that you learn better if you try first – it’s not a punishment, but an opportunity!) Then come back here and check your answer and your logic.

Answers

Example 2: SW1 Config with Port Security Added

Commentary

Often the configuration of port security does not need to be overly complex. As long as a few basic points about a port security implementation are known, these include:

• Port Security is disabled by default
• Once enabled, each port is allowed only a single MAC address by default
• The default violation mode is to shutdown the port resulting in a port in the err-disabled state
• A violation occurs if a frame is received from a MAC address not in its secure MAC address table
• The port security feature is not supported on dynamic mode ports

Another configuration option of the port security feature is to automatically convert dynamically learned MAC addresses to static secure MAC addresses. So what does this mean? Normally when an address is learned it will be counted against the secure MAC address limit (remember the default is 1) but this MAC address will not be placed into the configuration – it’s just in an internal table used by the port security feature. Should the switch be rebooted, the MAC address linked to the interface will be reset to the first one it sees traffic from. The alternative to this is to statically configure the MAC addresses of every attached interface; this is a time consuming task that is not feasible for most administrators; the alternative is to use sticky learning.

When using sticky learning the interface will listen for a device (or devices) on an interface. The first MAC address that is seen on the interface will be placed into the running configuration as a statically configured secure MAC address (this also works for multiple MAC addresses should the maximum be increased from its default of 1). All the administrator needs to do is wait for all the expected devices to send traffic and be seen by the switch. Once this is done then the only task left is to save the configuration.

Following the configuration in order:

• The switchport mode access command changes the port from its default dynamic status to statically be an access port.
• The switchport port-security command enables port security with all defaults.
• The switchport port-security sticky command tells port security to record into the running-config any learned MAC addresses that are legal (in other words, those that are not considered violations).
• The relevant defaults are: 1 MAC address per port.

Finally, you could have configure the three subcommands as shown in Example 3, using the interface range command, to save some typing.

Example 3: Using the interface range Command to Save Typing