Cisco swithport security - Revision history

Pio2pio: /* Verify */

2015-04-10T20:15:40Z

Verify

← Older revision		Revision as of 22:15, 10 April 2015
Line 23:		Line 23:
	S1#'''show port-security interface fa0/1'''		S1#'''show port-security interface fa0/1'''
	Port Security : '''Enabled''' #because of '''switchport port-security''' command applied		Port Security : '''Enabled''' #because of '''switchport port-security''' command applied
	Port Status : Secure-up #indicates port-security status, if '''Secure-shutdown''~~' is seen the~~ port is ~~disabled~~ in ''~~err~~-disabled'' state		Port Status : '''Secure-up''' #indicates port-security status, if ''Secure-shutdown'' port is in ''error-disabled'' state
	Violation Mode : Restrict #because of '''switchport port-security violation restrict''', ''shutdown'' ~~policy~~ is ~~by a~~ default		Violation Mode : '''Restrict''' #because of ''switchport port-security violation restrict'', ''shutdown'' is default
	Aging Time : 0 mins		Aging Time : 0 mins
	Aging Type : Absolute		Aging Type : Absolute

Pio2pio: /* Security Violation Modes */

2015-04-10T20:12:52Z

Security Violation Modes

← Older revision		Revision as of 22:12, 10 April 2015
Line 13:		Line 13:
	[[File:Cisco-violation-modes.png\|none\|650px\|left\|Cisco-violation-modes.png]]		[[File:Cisco-violation-modes.png\|none\|650px\|left\|Cisco-violation-modes.png]]

	Shutdown policy as other sources mention also ~~sends~~ sends an SNMP trap and logs a syslog message ~~what~~ is different to the table form CCNAv5 course.		* '''Protect''' - when a number MAC addresses reaches allowed number, packets from other ports are dropped, there is no notification
			* '''Restrict''' - same as '''Protect''' policy but there is notification that a security violation has occured
			* '''Shutdown''' (default) - shutdowns port, sets into ''error-disabed'' state

			''Note!'' Shutdown policy as other sources mention also sends an SNMP trap and logs a syslog message. This is different to the table form CCNAv5 course.

	= Verify =		= Verify =

Pio2pio: /* Verify */

2015-01-05T12:22:11Z

Verify

← Older revision		Revision as of 14:22, 5 January 2015
Line 54:		Line 54:
	Name: Fa0/1		Name: Fa0/1
	Switchport: Enabled		Switchport: Enabled
	Administrative Mode: '''static access''' #because of '''switchport mode access''' command, by a default it is set to 'auto'		Administrative Mode: '''static access''' #because of '''switchport mode access''' command, by a default it is set to 'dynamic auto'
	Operational Mode: static access		Operational Mode: static access
	Administrative Trunking Encapsulation: dot1q		Administrative Trunking Encapsulation: dot1q

Pio2pio: /* Configure */

2015-01-05T12:21:21Z

Configure

← Older revision		Revision as of 14:21, 5 January 2015
Line 3:		Line 3:
	= Configure =		= Configure =
	interface FastEthernet0/1		interface FastEthernet0/1
	switchport mode access !required ~~but I do not exactly WHY?~~		switchport mode access !required otherwise you'll get an error message: ''Command rejected: FastEthernet0/1 is a dynamic port''
	switchport port-security !enables port-security feature, if not applied the port security status will be disabled and sticky mac addresses can't be learnt		switchport port-security !enables port-security feature, if not applied the port security status will be disabled and sticky mac addresses can't be learnt
	switchport port-security maximum 2 !maximum mac addresses allowed		switchport port-security maximum 2 !maximum mac addresses allowed

Pio2pio: /* Security Violation Modes */

2015-01-03T15:09:31Z

Security Violation Modes

← Older revision		Revision as of 17:09, 3 January 2015
Line 13:		Line 13:
	[[File:Cisco-violation-modes.png\|none\|650px\|left\|Cisco-violation-modes.png]]		[[File:Cisco-violation-modes.png\|none\|650px\|left\|Cisco-violation-modes.png]]

	Shutdown policy as ~~other4~~ sources mention also sends sends an SNMP trap and logs a syslog message what is different to the table form CCNAv5 course.		Shutdown policy as other sources mention also sends sends an SNMP trap and logs a syslog message what is different to the table form CCNAv5 course.

	= Verify =		= Verify =

Pio2pio: /* Security Violation Modes */

2015-01-03T15:09:18Z

Security Violation Modes

← Older revision		Revision as of 17:09, 3 January 2015
Line 12:		Line 12:
	= Security Violation Modes =		= Security Violation Modes =
	[[File:Cisco-violation-modes.png\|none\|650px\|left\|Cisco-violation-modes.png]]		[[File:Cisco-violation-modes.png\|none\|650px\|left\|Cisco-violation-modes.png]]

			Shutdown policy as other4 sources mention also sends sends an SNMP trap and logs a syslog message what is different to the table form CCNAv5 course.

	= Verify =		= Verify =

Pio2pio: /* Configure */

2015-01-03T14:59:11Z

Configure

← Older revision		Revision as of 16:59, 3 January 2015
Line 8:		Line 8:
	switchport port-security mac-address sticky !enables sticky mac addresses learning		switchport port-security mac-address sticky !enables sticky mac addresses learning
	switchport port-security violation restrict !sets violation policy to ''restrict'',		switchport port-security violation restrict !sets violation policy to ''restrict'',
	switchport port-security mac-address sticky 00E0.B027.2245 !saves learnt mac address to configuration file		switchport port-security mac-address sticky 00E0.B027.2245 !auto-created - saves learnt mac address to configuration file

	= Security Violation Modes =		= Security Violation Modes =

Pio2pio: /* Verify */

2015-01-03T14:54:11Z

Verify

← Older revision		Revision as of 16:54, 3 January 2015
Line 17:		Line 17:
	S1#'''show port-security interface fa0/1'''		S1#'''show port-security interface fa0/1'''
	Port Security : '''Enabled''' #because of '''switchport port-security''' command applied		Port Security : '''Enabled''' #because of '''switchport port-security''' command applied
	Port Status : Secure-up		Port Status : Secure-up #indicates port-security status, if '''Secure-shutdown''' is seen the port is disabled in ''err-disabled'' state
	Violation Mode : Restrict #because of '''switchport port-security violation restrict''', ''shutdown'' policy is by a default		Violation Mode : Restrict #because of '''switchport port-security violation restrict''', ''shutdown'' policy is by a default
	Aging Time : 0 mins		Aging Time : 0 mins

Pio2pio: /* Verify */

2015-01-03T14:50:32Z

Verify

← Older revision		Revision as of 16:50, 3 January 2015
Line 15:		Line 15:
	= Verify =		= Verify =

	S1#sh port-security interface fa0/1		S1#'''show port-security interface fa0/1'''
	Port Security : '''Enabled''' #because of '''switchport port-security''' command applied		Port Security : '''Enabled''' #because of '''switchport port-security''' command applied
	Port Status : Secure-up		Port Status : Secure-up
Line 29:		Line 29:
	Security Violation Count : 0		Security Violation Count : 0

	S1#show port-security		S1#'''show port-security'''
	Secure Port MaxSecureAddr CurrentAddr SecurityViolation Security Action		Secure Port MaxSecureAddr CurrentAddr SecurityViolation Security Action
	(Count) (Count) (Count)		(Count) (Count) (Count)
Line 37:		Line 37:
	----------------------------------------------------------------------		----------------------------------------------------------------------

	S1#sh port-security address		S1#'''show port-security address'''
	Secure Mac Address Table		Secure Mac Address Table
	-------------------------------------------------------------------------------		-------------------------------------------------------------------------------
Line 49:		Line 49:
	Max Addresses limit in System (excluding one mac per port) : 1024		Max Addresses limit in System (excluding one mac per port) : 1024

	S1#sh int fastEthernet 0/1 switchport		S1#'''show int fastEthernet 0/1 switchport'''
	Name: Fa0/1		Name: Fa0/1
	Switchport: Enabled		Switchport: Enabled

Pio2pio: /* Verify */

2015-01-03T14:49:52Z

Verify

← Older revision		Revision as of 16:49, 3 January 2015
Line 48:		Line 48:
	Total Addresses in System (excluding one mac per port) : 0		Total Addresses in System (excluding one mac per port) : 0
	Max Addresses limit in System (excluding one mac per port) : 1024		Max Addresses limit in System (excluding one mac per port) : 1024


	S1#sh int fastEthernet 0/1 switchport		S1#sh int fastEthernet 0/1 switchport
	Name: Fa0/1		Name: Fa0/1
	Switchport: Enabled		Switchport: Enabled
	Administrative Mode: static access		Administrative Mode: '''static access''' #because of '''switchport mode access''' command, by a default it is set to 'auto'
	Operational Mode: static access		Operational Mode: static access
	Administrative Trunking Encapsulation: dot1q		Administrative Trunking Encapsulation: dot1q