Lesson 25 - Switch Port Security

This post is the last one related to layer 2 technologies. With the next posts, I will shift my focus to layer 3 technologies. If you use GNS-3 or dynagen (dynamips emulator), you'll be able to perform all routing tasks on your computer as long as you have IOS image.

Switchport Port Security
This IOS feature (switch only) allows you to limit the number of MAC addresses that will be serviced on a given port. It comes with multiple options such as which MAC address(es) is/are going to be allowed on a given port, and what action should be taken when the violation of the policy occurs. This way, you can further protect your entry point in the network (access switches).

By default, the port security is turned off on all interfaces. In order to turn it on, a port must be in an access mode. Otherwise the command will be rejected. Check out the below attempt of enabling it when the port is in a 'dynamic desirable' rather than an access mode.

Pic. 1 - Port security (switchport port-security) command rejected.

 

The proper sequence of the commands to enable port security on F0/1 would be as follows:

SW1(config)#interface fastethernet0/1

SW1(config-if)#switchport mode access

SW1(config-if)#switchport port-security

The above configuration applies a default security policy on the port. What settings are going to be used here may vary between switch platforms. But typically, the port in a secure mode allows only aSINGLE MAC address (just one) to be serviced and in the case when the violation occurs, the port will be put in ERR-DISABLE state. This state will put the port down so, no traffic can traverse it.

For the purpose of my presentation, I will use very simple topology (Pic. 2).

Pic. 2 - Topology

Icons designed by: Andrzej Szoblik - http://www.newo.pl

My router R1 is connected to SW1 port F0/1. The MAC address of the R1 (E0/0 port) is:
0050.500f.6600

Now, I want accomplish the two goals:

• R1 E0/0 port should be connected to SW1 port F0/1. In case, the R1 is connected to any other port on this switch, the communication with the R1 should not be allowed.
• SW1 port F0/1 should service traffic to/from R1 E0/0 interface. In case, somebody connects more devices to port F0/1 than R1 port E0/0, and/or different device, the port F0/1 should be put in an ERR-DISABLE state.

Let us go ahead and configure it!

I need to show you what the current status of the SW1 port F0/1 is, before we apply port security.

Pic. 3 - SW1 port F0/1 Before Security is applied

As you see, the MAC address of the R1 E0/0 interface has been learned dynamically from the incoming frames on SW1 port F0/1. At this stage, I must explain the difference between dynamic and static entries in the MAC address table.

• DYNAMIC - the entry is created from the incoming frames by reading the source MAC address field in the Ethernet header. The entry is valid for 5 minutes (300 seconds) by default. If the host with this source address (here R1) does not send any frame towards the port of the SW1 for 300 seconds, the entry is removed. Every time, the R1 sends a frame towards the SW1 F0/1, the entry timer is reset, or if the entry has already been removed, the same MAC address is mapped to the port again.
• STATIC - the entry (MAC address) is permanently mapped to a specific port. It does not age like a 'dynamic' entry. The switch does not create this MAC address to port mapping by reading the source MAC address, but it is the administrator of the switch that creates it in the global config mode using 'mac address-table static' command.

 So, the question is: what is the difference in operation if you use static over dynamic method?

In case of static mapping of MAC address to a port, you CANNOT move this device to any other port as it will not work! The switch expects to receive the frames sourced from the device on the specific port. If it receives the frames with the MAC address on different port than assigned statically, it will drop the frames from that device.

If you rely on dynamic address learning (default), you can plug in a device to any port and quickly the switch flushes the entry from the old port (where the device was connected previously) and re-learns the MAC address on the new port you have just connected your device to.

Knowing that, we can proceed with our security plan now. I have applied the port access and port security commands like presented above. Now, take a look at the default settings applied on this specific switch platform I use (Catalyst 2950). Bear in mind, that your switch may have different default settings.

Pic. 4 - Port in Secure Mode.

Quick dissection of the output's essential information:

• Secure Port - F0/1 is now working in a secure mode.
• MaxSecureAddr - The maximum number of addresses allowed on this port is 1 MAC address.
• CurrentAddr - At this moment, this maximum limit has been reached.
• SecurityViolation - Currently there's been no security violation reported.
• Security Action - In case there is a security violation detected, the port will go DOWN (err-disable).

Let's see which MAC address is now in the secure mode (it should be R1 E0/0).

Pic. 5 - Current Secure MAC Address.

Everything seems good so far. F0/1 port learned dynamically the MAC address of our R1, and is now considered a secured MAC address. One of our two goal plan seems to be working. What if we moved the R1 to another port? What would happen then?

Pic. 6 - MAC address with security enabled.

This specific switch (C2950) has also made the entry 'static' which means, that if you move R1 E0/0 port to another port of this switch, the traffic from R1 will be discarded!

Well, you can further improve the security of your R1. The problem is, that with current configuration, you can reboot the switch and while doing so, you can plug in a different device to F0/1. This way the newly learned MAC address upon reload of the switch becomes the secure one. 

In order to make it more secure, it is recommended that you configure the secure MAC address permanently. Just like in the example below:

SW1(config)#interface f0/1

SW1(config-if)#shutdown

SW1(config-if)#switchport port-security address 0050.500f.6600

SW1(config-if)#no shutdown

SW1(config)#end

SW1(config)#wr

Pay attention to some of the commands presented. I shut the port down first to flush the current (the same) MAC address. Otherwise this command would be rejected (duplicate MAC address). Then, after adding the MAC address, I brought the port up and saved my configuration.

Now, the MAC address becomes the part of configuration and the security applied can withstand the reboot of the switch.

Pic. 7 - Configuration saved in NVRAM.

There is one more command that offers more detailed output (pic. 8).

Pic. 8 - Port security detailed output

Take a look at some interesting options shown below:

Pic. 9 - Port security options.

• Aging - there are two types of secure MAC address aging: 'absolute' and 'inactivity'. The former, allows to specify how long the MAC address should be considered secure, the latter decides that MAC address is no longer secure if it is not transmitting data in a given time. Both parameters can be configured but, as per default, the secure MAC addresses do not age.
• Mac-address - like in my configuration, this option specifies which address is to be secured. You can type in a specific MAC address (like I did) or use a 'sticky' keyword. When 'sticky' is used the MAC address(es) already learned on the port become part of the interface's configuration. However, adding MAC address manually is recommended. Just like I did.
• Maximum - how many MAC addresses can be considered secure on a given port (platform dependent). The default is: 1.
• Violation - this option allows to choose one of the three options as to what action must be taken if the violation of the security is detected. 

Port Violation Actions

1. Protect - when the port receives the traffic from the MAC addresses which are not configured as secure, it silently drops those transmissions. There is NO notification logged about the violation occurring on a port.
2. Restrict - similar to 'protect' only the switch logs the violations detected.
3. Shutdown (default) - the port will transition to err-disable upon detecting the violation.

Let me quickly show you what happens if my switch detects the violation of the port security.

I am going to change the MAC address on my E0/0 port of R1 to:
0000.aaaa.aaaa

As a result of that, the first frame sent towards the SW1 F0/1 will cause the violation of my policy (wrong MAC address, and the port allows only one MAC address previously assigned as the secure one).

Pic. 10 - The log generated after violation on the port occurred.

Below is the status of the port now.

Pic. 11 - Port in err-disable state upon violation of security.

The only way to rectify the situation is to do the following:

1. Plug in the device with the right (secure) MAC address back to the port F0/1.
2. Shut the port down manually (administrative mode shutdown).
3. Bring the port up using: 'no shutdown' command.

This way has one major disadvantage. Well, it seems you have to perform the three steps mentioned above which looks like you are being punished for somebody else's security violation.

You can configure two additional commands in the global configuration mode which allow your switch to attempt to bring the port automatically after a period of time in err-disable mode. If the proper device is already connected, the port will be fully functional again.

SW1(config)#errdisable recovery cause psecure-violation

SW1(config)#errdisable recovery interval 60

The first command instructs the switch to pay attention to any ports in err-disable state. If such ports exist, the switch will attempt to bring them up after 60 seconds of putting the in err-disable mode (second command).

In my next post, we will start talking about layer 3. I propose that we refresh our knowledge of binary system which is essential to understand IP addressing scheme.

Lesson 10 - Cisco Discovery Protocol

In the previous lesson we have explored how switches build their mac address table (aka Content Addressable Memory). It is critical to understand those concepts in order to perform troubleshooting related to connectivity issues.

In this lesson we'll continue studying layer 2 technologies. Today's theme is Cisco Discovery Protocol. This protocol comes in handy in many situations (trust boundary for Cisco IP Phones, auto qos and others).

What is Cisco Discovery Protocol?
CDP is Cisco proprietary layer 2 protocol. It is enabled by default on majority of Cisco devices including IP phones. It can work on any connections supporting SNAP (such as LANs, but also ATM and Frame-Relay). The only time you'll see the CDP turned off by default, is when you use frame-relay configured interfaces.

What does CDP do?
Every Cisco device using this protocol, reports information about itself by advertising special packets out of its all active interfaces. The important pieces of information it advertise include its:

• Hostname
• Platform
• Ports where CDP packets are advertised
• IOS version
• IP address

CDP can help administrator discover Cisco devices connected and create a  topology diagram or prepare an inventory of the gear used. It can also be an additional tool in troubleshooting problems in the network. Working as a support technician, I found it useful numerous times.

Let's take a quick tour through the CLI (command line interface) and see what major commands CDP allows us to use and what they show.

I'm connected to my Cisco switch SW1 and in the privileged mode type in the following command:

Pic. 1

Using our best friend '?' we can see the CDP options. The last line '' stands for: 'carriage return'. A good, old-fashioned terminal lingo for 'press enter'. Let's try this first.

Pic. 2

Based on the output (Pic. 2) we see that CDP version 2 is enabled, the information packets (though technically should be called frames) are sent every 60 seconds. We also learn, that SW1 will keep CDP information it receives from its Cisco neighboring devices for 180 seconds (holdtime). Let's look at another CDP command:

Pic. 3

In the Pic. 3 we can see the traffic statistics such as CDP packets sent, received, any CDP encapsulation problems etc.

The below command (output in Pic. 4) will tell you which interfaces CDP is running on.

SW1#show cdp interface  

You can disable CDP on a specific interface or group of interfaces. For instance, if you do not want to run CDP on Fas0/1 interface, you could use the following command:

SW1#configure terminal

SW1(config)#interface Fas0/1

SW1(config-if)#no cdp enable

If you want to disable CDP on a group of interfaces you can use 'interface range' command. For instance, disabling CDP on Fas0/1, Fas0/2, Fas0/5 and Fas0/8 would look like this:

SW1#configure terminal

SW1(config)#interface range fas0/1 - 2 , fas0/5 , fas0/8

SW1(config-if-range)#no cdp enable

---

NOTICE

If you use the 'interface range' command, the consecutive ports can be specified with '-' but make sure your use 'space' before and after '-' (fas0/1 - 2). The same applies to non-consecutive ports (fas0/5 , fas0/8). There is 'space' before and after the comma character ','.

---

As you will see later, CDP discloses some vital information (e.g. IOS version), so for the security reasons you may decide to turn off CDP altogether. Be careful before you do that though, as some application may rely on this protocol. Disabling CDP can cause cascading problems in your network. The command which disables CDP completely (on all interfaces) is:

SW1#configure terminal

SW1(config)#no cdp run

Pic. 4

Now, let's see what neighboring devices SW1 discovered by listening to their CDP packets (Pic. 5).

Pic. 5 

Dissecting the Pic. 5 output we learn the following:

• SW1 received CDP packets from the device named 'R1' (hostname).
• This CDP packet was sent from R1's Fas0/0 interface (the last column 'Port ID').
• SW1 received this CDP information packet on its Fas0/1 local interface ('Local Intrfce').
• This leads us to a conclusion that R1's Fas0/0 interface is directly connected to SW1'sFas0/1 interface.
• R1 neighbor is a router as the capability list shows 'R S I' (R=router, S=switching capability, I=IGMP support).
• R1 is 2611XM platform.

That's not all by any means. There is another command we can use to obtain more information about R1. Click at the Pic. 6

Pic. 6

It shows you information about IOS version running on R1, as well as its IP address 192.168.10.254 configured on Fas0/0 interface. Now you understand why you might consider turning off CDP on some interfaces. You do not want to show such details to a third party company (like your service provider), that connect to your devices.

Instead of using 'show cdp entry R1', you can also use the following command that displays detailed (similar to Pic. 6) output about ALL discovered neighbors :

SW1#show cdp neighbor detail

In lesson 11, you will learn the commands related to switch mac-address-table which was covered in theory only (lesson 9). Also, we'll hone all our skills we have obtained so far. Things will begin to fall into place. At least that's my hope.

Lesson 7 - Building a Home Network

Now let's get to the basics of home network building and clearify It's an Easy job to do with the right

approach and the willing of doint it. I hope this won't get you bored and I'm sure of it :)

We will need few components to build this network. First of all, we'll need computers, running some operating system that can talk across the network (like Mac OS, Windows, Linux).

Computers.

Computers are already equipped with NICs (Network Interface Cards) by the manufacturer.

"What does the NIC look like dad?" - He interrupts. Nine years old kids can be very tenacious, almost obsessive. They are not easily dismissed. They won't stop unless they're fully satisfied with the answer. So, I'm taking one NIC out of the computer and explain that it is plugged in to the PCI slot in order to work. "PCI slot is connected to the motherboard of the computer and the operating system uses a special piece of software to talk to the NIC. It's called a driver. The driver translates between an operating system and the NICs hardware. The NIC sends bits down to the wire and knows what to do when bits come back from the network". Bits are small pieces of information (1s and 0s) which in software make data like music, pictures, text documents etc.

NIC (Network Interface Card).

"Okay." - Mattie says, "But what else will you need?

"I will need Unshielded Twisted Pair cables (UTP). One, for each computer. The cables (sometimes referred to as Ethernet cables), use RJ-45 connectors that the most commonly used nowadays." - I reply. "Here's the cable without the connector:

 UTP cable without RJ-45 termination

"Mattie's looking at the cable and I know what's going to happen next. "Dad, why does it have so many wires and why are those twisted like that?"

One pair of the wires (two wires) are used to transmit data. Another pair, is used to receive data from the network. Other wires can be used to carry the power to some types of the devices (PoE devices) or to accomplish faster speeds (1Gbps etc.). They are twisted like that on purpose. The guy who invented that concept was Graham Bell. He invented it for the telephony purposes and patented that in 1881. He discovered that twisting wires (conductors) minimized or canceled Electromagnetic Interference (EMI) from external sources and, so called, cross talk from the neighboring wires.

The cable must be terminated at both ends with RJ-45 type of connector, like the one depicted below:

RJ-45 Connector.

Below is the cable with the connectors.

UTP cable with RJ-45 connectors.

The UTP cables can have different category numbers (CAT 1-6). The higher the category number is, the better quality of the cable, the faster, and better transmissions are going to be. Also, the UTP cables can be terminated in two different ways like explained below.

Straight-Through Cable
In straight through cable the transmitting pair of wires are 1 and 2, the receiving pair of are wires3 and 6. There are two major standards (ways) of using the colored wires, but important thing is, that the colors on the both ends of the cable are terminated identically. Please, look at the picture below.

Straight Through Cable.

Cross-over Cable
In the cross-over cable, the position of the wires is changed such that the sending pair is terminated at the receiving pair on the other side of the cable. It is illustrated below.

Cross-over Cable

My son Mattie's holding both types of cable, looking at them and I know I cannot dismiss him with that explanation. So, I continue.

If you connected two computers together and the NICs are wired identically, you would connect the sending pair (pins 1 and 2) to the sending pair on the other end. This obviously would not work. You must connect sending pair on one end (pins 1 and 2) to the receiving pair (pins 3 and 6) on the other end. For instance, if you connect the following devices together, you'll need cross-over cable:

• computer-to-computer
• switch-to-switch
• hub-to-hub
• computer-to-router (directly)

---

NOTICE!
Modern NICs can 'sense' the type of cable and adjust the operation regardless of the cable used. But this is not always the case.

---

Devices such as hubs and switches, are designed such way they can use straight-through cables. The cross between the transmitting and receiving pairs is done in their port controllers. So, the following device connections will use straight-through cable:

• computer-to-hub
• computer-to-switch
• router-to-hub
• router-to-switch

Now, all we have to do is to connect the cables to the the hub, configure IP addresses on the NICs and voila! They can talk to one another.

Ethernet Hub
It is a simple device that allows to connect a few computers together. Look at the typical, cheap hub you can buy for home purposes:

An Ethernet Hub.

Lesson 2 - Navigating in Cisco IOS

Time to go further with our IOS navigation... It's gonna be fun :)

Once, you have connected to your Cisco switch or router console port, and power up the device you will see some information displayed during the start of the device. If the device has no initial configuration you are presented with:

Pic. 1 - System Configuration Dialog

You can safely cancel this request as its capability to configure the device is not very impressive. Instead, you are going to do things all professionals do: command after command.

What follows is bunch of messages sent to the screen and after hitting the Enter key few times you get something like this (here is the router, but a switch would introduce itself as ... Switch> ):

Router>

IOS Modes (contexts)

This prompt of the device tells you in which 'context' you are, and the one above with the '>' character is known as 'user exec mode' or 'privilege level 1 mode'. You can't configure much in this mode of operation. It is designed as a 'monitoring' mode not a 'configuration' one. Also, the monitoring capability is limited. For instance, you can't see the running configuration of the device.

Type in the following command:

Router>enable

Router#

The prompt changes to '#' which is called 'privileged exec mode', 'enabled mode' or sometimes 'privilege level 15 mode'. I would like to draw your attention to two things here. Both modes of operation (or contexts, if you like) have two things in common:

1. They are used primarily to monitor the device (you will be using 'show' and 'debug' commands in those modes).
2. They are context for immediate execution of your commands. If the syntax is correct, system executes the command immediately.

Those two modes differ from one another as well:

1. User Exec Mode - is limited in terms of what information will be available.
2. Enabled Exec Mode - gives the operator ALL information (like root or Administrator account on a computer).

Question Mark 

As the commands take many attributes your best friend is the question mark '?'. This help is known as the 'context-sensitive help'. This means that depending on which context you use, while typing a question mark (?) the system is going to list the commands that can be executed in that particular mode of operation. See more in the attached video.

Configurations

In order to configure things in Cisco IOS (except for some minor changes), you must enter the 'global configuration mode' first which is characterized by the following prompt:

Router(config)#

This context can be accessed by typing the following command in the 'privileged exec mode':

Router#configure terminal

Whatever you configure this particular mode it is going to be applied to the device as a whole unit(e.g. hostname, default gateway on a switch etc.).

If you want to enter the context of the interface to configure it with some parameters like ip address, speed, duplex, description etc. , you must enter that interface from the global configuration mode like the one below:

Router(config)#interface fastethernet1/0

If you do not know what interfaces your device has, type the following command in the enabled mode:

Router#show ip interface brief

As you see, in the 'global configuration mode' I did the following actions in order to access the context of the interface:

1. Entered the interface type (here: Fast Ethernet).
2. Referenced the module number (here: 1)
3. Referenced the port number in the module 1 (here: 0)

Please, note that routers count ports starting from 0, switches starting from 1.

You'll learn other contexts as we go through numerous labs and video presentations.

Abbreviations

You don't have to type in the full words of the commands and certain attributes that follow the commands. For instance, instead of typing:

Router#configure terminal

Router(config)#

You can type:

Router#conf t

Router(config)#

As long as the abbreviation uniquely describes which command you want to use, the system has no problem accepting it.

Shortcuts And Keystrokes

When you type enough of the characters that uniquely identify the command in a given context you can use 'tab' key and the system is going to complete the command on the screen for you (just like in Linux).

I often use the following keystrokes while editing the commands:

• CTRL-z - takes the cursaor back to the 'enabled exec' mode from any other context
• CTRL-a - takes the cursor to the beginning of the line
• CTRL-e - takes the cursor to the end of the line
• CTRL-k - erases everything to the right of the cursor
• CTRL-u - erases everything to the left of the cursor
• Upper Arrow or CTRL-P - displays previous command from the history buffer
• Lower Arrow or CTRL-N - displays next command from the history buffer

System keeps the record of up to ten (default) commands you typed in. You can increase/decrease the history buffer up to 256 commands.

If you want to check the history buffer size, type in:

Router#show terminal | include history

Changing the buffer size can be accomplished with the following command in the 'enabled mode'

Router#terminal history size 256

The above command  will increase the size of the history buffer to 256 commands.

If you want to see the buffer (which commands were typed) use this command:

Router#show history

Please, take a look at the video I posted below to see most of those things in action. Practice them until you are confident with the content of this lesson before you proceed to the next one.