- [Instructor] How many MAC addresses,
should legitimately show up inbound, on an access port?
Port security controls,
how many MAC addresses can be learned,
on a single switch port.
This feature is implemented on a port by port basis.
A typical user uses just a single MAC address.
Exceptions to this may be a virtual machine or two,
that might use different MAC addresses than their host
or if there is a IP phone with a built in switch,
which may also account for additional MAC addresses.
In any case to avoid a user connecting dozens of devices,
to a rogue switch that is then connected,
to their access port,
you can use port security to limit the number of devices
or MAC addresses on each port.
This also protects against malicious applications,
that may be sending thousands of frames into the network,
with a different bogus MAC address for each frame,
as the user tries to exhaust the limits,
of the dynamic MAC address table on the switch,
which might cause the switch to forward all frames,
to all ports within a VLAN,
so that the attacker can begin to sniff all packets.
This is referred to as a CAM table overflow attack.
Content Addressable Memory, CAM, is a fancy way,
to refer to the MAC address table on the switch.
Port security also prevents the client,
from depleting DHCP server resources,
which could have been done,
by sending thousands of DHCP requests,
each using a different source MAC address,
DHCP spoofing attacks take place,
when devices purposely attempt to generate,
enough DHCP requests, to exhaust the number of IP addresses,
allocated to a DHCP pool.
With the port security feature,
the default violation action is to shut down the port.
Alternatively, we can configure the violation response,
to be to protect, which will not shut down the port,
but will deny any frames from new MAC addresses,
over the set limit.
The restrict action does the same as protect,
but generates a Syslog message as well.
You can see an example of port security configuration here.
In this demo,
we will be enabling the port security interface,
on a specific interface.
We'll start out by entering the interface configuration.
From there, we'll enable the switch port,
port security configuration using,
the command switch port, port security.
Moving on, we'll set the maximum number of MAC addresses,
that are allowed to connect to this interface.
The default is one,
so if we administratively set the maximum to one,
the command won't show in the running configuration
because the configuration matches the default value.
Next we'll set the violation action.
The switch port, port security violation protect command,
will simply not allow frames from MAC addresses,
above the maximum.
Next we'll set the MAC address, sticky command,
this will cause the dynamic MAC addresses to be placed,
into the running config.
To verify all of our commands,
we can run the show port security command.