Configure Cisco Port Security on Switches and Router interface

Cisco Port Security is a features that can help secure access to the physical network. Any Network admins nightmare is an unauthorised device or a PC connecting to the network. This could be as simple as an innocent guest plugging his PC into a floor port hoping to get an internet connection or a malicious intruder connecting to the network trying to gain access to confidential information.

Consequences could as bad as

• Virus, Spyware or malware infection from a PC unprotected PC
• A malicious hacker or an intruder gaining access to the network
• A malicous attacker launching a Denial of Service attack using MAC Address flooding

Cisco IOS has the port-security feature which can be used to restrict the MAC-Address of the devices that connects to each of the physical switchports.

Cisco Port-Security can help to

• restrict the MAC-address or addresses that can connect through a switchport [default: first connected device MAC Address]
• restrict the number of MAC-Addresses that can connect through a switchport [default is 1 and maximum is 128]
• set aging in minutes of the MAC Addresses registed
• Action to take when there is a violation detected (default is to disable the port and send an SNMP Trap message to the SNMP management server (if any))

For a switch port to be security enabled,

• the switchport cannot be a Trunk Port
• the switchport cannot be a destination port for a Switchport Analyzer (SPAN)
• the switchport cannot belong to an EtherChannel port-channel interface
• the switchport cannot be an 802.1X port

If you try to enable 802.1X on a secure port, an error message appears, and 802.1X is not enabled. If you try to change an 802.1X-enabled port to a secure port, an error message appears, and the security settings are not changed.

To enable Port Security on a Cisco Switch or router interface

Enter the interface config mode (say fa0/1)

Switch# conf t

Switch(config)# interface fastethernet 0/1

Switch(config-if)# switchport mode access

This sets the switchport to access mode. Default mode of "Dynamic desirable" cannot be configured as a secure port

Switch(config-if)# switchport port-security

This enables the port security on the switchport with the defaults [1 MAC Address allowed, 1st connected MAC Address, disable port if there is a violation]

If you know the MAC Address of the device and that thats the only device that connects to the swicthport (for example, A server on a Serverfarm switch) then you can set the MAC-Address manually.

Switchport(config-if)# switchport port-security mac-address 1111.2222.3333

Where 1111.2222.3333 is the MAC Address of the server. This will disable the secure port, if any other device other than the one with the above MAC-Address connects to the switch port.

If there is a switch or a hub (say 12 port or a 24 port) that connects to the switchport which you want to secure then you can set the maximum number of MAC-Addresses that connects to the port and/or set the MAC-Address optionally.

Switchport(config-if)# switchport port-security max 12

This sets the maximum number of mac-address allowed on the secure port (default is 128).

One step further, if you want to manually add some or all of these MAC-Addresses then you can specify using the following command one for each MAC-Address

Switchport(config-if)# switchport port-security mac-address 0000.0000.0000

Switchport(config-if)# switchport port-security mac-address 0000.0000.1111

If now, you need to set the maximum number of MAC Addresses on the switchport but are aware that some or most of them are temporary ones (guest users or temporary workers) then you can set the aging time on the port-security which allows MAC-Addresses on the Secure switchport will be deleted after the set aging time. This helps to avoid a situation where obsolete MAC-Address occupy the table and saturates causing a violation (when the max number exceeds).

Switchport(config-if)# switchport port-security aging time 10

Where time is specified in minutes (10 mins in the above)
 
Now, you can set the action to be taken when there is a violation. The default is to shutdown the port and mark the port err-disabled.

For example,

Switchport(config-if)# switchport port-security violation protect

Where protect is the action taken when a violation event is triggered.

The actions are

protect — Drops packets with unknown source addresses until you remove a sufficient number of secure MAC addresses to drop below the maximum value.

restrict — Drops packets with unknown source addresses until you remove a sufficient number of secure MAC addresses to drop below the maximum value and causes the Security Violation counter to increment.

shutdown (default) — Puts the interface into the error-disabled state immediately and sends an SNMP trap notification.

To show the port-security,

Switch# show port-security interface fastethernet 0/1
Security Enabled:Yes, Port Status:SecureUp
Violation Mode:Shutdown
Max. Addrs:5, Current Addrs:0, Configure Addrs:0

To display port-security info without any interface provided

Switch# show port-security
Secure Port      MaxSecureAddr  CurrentAddr  SecurityViolation  Security
Action
                    (Count)        (Count)      (Count)
—————————————————————————-
     Fa0/1           11            11            0            Shutdown
     Fa0/2           15            5             0            Restrict
     Fa0/3           5             4             0            Protect
—————————————————————————-
Total Addresses in System: 21
Max Addresses limit in System: 128

To display the security MAC-Address table

Switch# show port-security address
          Secure Mac Address Table
——————————————————————-
Vlan    Mac Address       Type                Ports   Remaining Age
                                                         (mins)
—-    ———–       —-                —–   ————-
   1    0001.0001.0001    SecureDynamic       Fa0/1      15 (I)
   1    0001.0001.0002    SecureDynamic       Fa0/1      15 (I)
   1    0001.0001.0003    SecureConfigured    Fa0/1      16 (I)
   1    0001.0001.0004    SecureConfigured    Fa0/1      –
   1    0001.0001.0005    SecureConfigured    Fa0/1      –
   1    0005.0005.0006    SecureConfigured    Fa0/5      23
   1    0005.0005.0007    SecureConfigured    Fa0/5      23
   1    0005.0005.0008    SecureConfigured    Fa0/5      23
   1    0011.0011.0009    SecureConfigured    Fa0/11     25 (I)
   1    0011.0011.0010    SecureConfigured    Fa0/11     25 (I)
——————————————————————-
Total Addresses in System: 10
Max Addresses limit in System: 128

For more information, check this Cisco documentation