14 - Security Services II - Port Security Flashcards
How does Port security work?
Identifying devices based on their source MAC from Ethernet frames to restrict which devices can be connected either statically or dynamically
What are Sticky secure MAC addresses?
Port security feature that learns the MAC addresses off each port and adds them to the running-config file so that you do not have to pre-configure them
What command is used to enable port security on an interface?
Interface subcommand:
switchport port-security
What switchport configuration command is used to set the maximum number of allowed MACs?
switchport port-security maximum 10
What switchport configuration command is used to override the default action to take upon violation?
switchport port-security violation {protect | restrict | shutdown}
How do you predefine an allowed source MAC for an interface?
switchport port-security mac-address 0200.1111.1111
How do you make an interface ‘sticky learn’ MACs for port security?
switchport port-security mac-address sticky
What is the difference between dynamic and sticky Port security?
Sticky saves Port security commands in the running config whereas dynamic does not
What do you need to make sure you do if you are configuring port security on voice ports?
Make sure you configure it to allow at least 2 MACs
Where would you configure Port security for Ether-channels?
On the port-channel interface, not the individual interfaces that make up the channel
How do you verify Port security?
show port-security interface Ge0/1
How do you show all MAC addresses that are associated with ports using Port security?
show mac address-table secure
How do you show all MAC addresses that are associated with ports using Port security, and any other statically defined MACs?
show mac address-table static
True/False: Sticky learned MACs for Port security show in the output of dynamic MAC addresses (show mac address-table dynamic)
False.
Sticky learned addresses are considered to be static entries
How do you show MAC address table entries just for a specific interface?
show mac address-table {secure} interface Ge0/1
How would you define a Port security violation?
Any frame received on a given interface that violates the Port security rules configured for that interface
What state would a port be put into after Port security violation and Shutdown mode is configured?
Err-disabled state
What commands would show err-disabled for an interface state (not port security interface state) that has had a Port security violation Shutdown?
show interfaces
show interfaces status
How do you recover a port from the err-disabled state?
You must shutdown the port then re enable it
shutdown
no shutdown
How can you configure a switch to automatically recover interfaces placed into the err-disabled state by Port Security?
errdisable recovery cause psecure-violation
How can you adjust the time to wait before automatically recovering ports shutdown by Port security (if enabled)?
errdisable recovery interval {seconds}
How can you show a quick summary of interfaces and Port security?
show port-security
What does the Last Source Address:Vlan field show in the output of show port-security interface?
The MAC and VLAN of the device that caused the violation
What do the Protect and Restrict violation modes do differently to Shutdown?
- Interface remains connected in secure-up state
- Only discards offending traffic
What does Protect violation mode do when an offending frame arrives?
It only discards the frame, but does not increment the violations counter
What does Restrict violation mode when an offending frame arrives?
It discards the frame, and increments the violation counter and generates syslog messages
What will the interface state and interface port security states show for an interface on which a Port security violation has occurred and Shutdown violation mode is configured?
Interface state: err-disabled
Port security interface state: secure-down
True/False: show mac address-table dynamic lists MAC entries for MAC addresses configured by Port security
False
Which two show mac address-table commands list MACs for entries configured by port security?
show mac address-table
show mac address-table static
