CCNA 2 - Capitulo 11

CCNA 2 - Capitulo 11

1. SWITCHING SECURITY CONFIGURATION

   • IMPLEMENT PORT SECURITY
     • SECURE UNSED PORTS
       • LAYER 2
         • ARE CONSIDERED WEAKEST LINK IN SECURITY INFRAESTRUCTURE
         • ARE SOME OF THE EASIEST FOR HACKERS
       • BEST PRACTICES ?
         • SWITCHPORTS SHOULD BE SECURE BEFORE DEPLOYED USE
         • DISABLE ALL ULSED PORTS ON A SWITCH
     • MITIGATE MAC ADDRESS TABLE ATTACKS
       • EFFECTIVE METHOD TO PREVENT ATTACK ?
         • PORT SECURITY
           • WHAT IT DOES?
             • LIMITS THE NUMBER OF VALID MAC ALLOWED ON A PROT
           • PORT CAN BE CONFIGURED
             • THE SOURCE MAC ADDRESS OF THE FRAME IS COMPARED LIST OF SECURE SOURCE MAC
             • DYNAMIC
             • MANUALLY
           • HOW CAN IT BE ENABLED?
             • CAN ONLY BE CONFIGURED ON OR
               • MANUALLY ACCESS PORTS
               • MANUALLY CONFIGURED TRUNK PORT
             • CANNOT BE CONFIGURED WITH DYNAMIC AUTO
               • MUST BE ACCESS PORT
             • EXAMPLE COMMAND CONFIGURATION
               • (1) S1(CONFIG)#INTERFACE F0/1
               • (3) S1(CONFIG)#SWITCHPORT PORT-SECURITY
                 • AFTER PORT SECURITY IS ENABLED , OTHER PORT SECURITY CAN BE CONFIGURED
                   • PORT SECURIT AGING
                     • TWO TYPES OF AGING ARE SUPPORT
                       • STATIC
                         • ENABLE AGING FOR STATICALLY
                         • S1(CONFIG-IF)# SWITCHPORT PORT-SECURITY MAC-ADDRESS FF:FC:FC:CD:FC:AA
                       • DYNAMIC
                         • TYPE ABSOLUTE
                           • SECURE ADDRESS PORT ARE DELETED AFTER SPECIFIED AGING TIME
                           • 1 - S1(CONFIG-IF)# SWITCHPORT PORT-SECURITY AGING TYPE ABSOLUTE
                           • 2 - S1(CONFIG-IF)#SWITCHPORT PORT-SECURITY AGING TIME 5
                         • TYPE INACTIVITY
                           • SECURE ADDRESSES THE PORT ARE DELETED
                             • THEY ARE INACTIVE FOR SPECIFIED AGING TIME
                           • 1 - S1(CONFIG-IF)# SWITCHPORT PORT-SECURITY AGING TYPE INACTIVITY
                           • 2 - S1(CONFIG-IF)#SWITCHPORT PORT-SECURITY AGING TIME 5
                     • USED FOR REMOVE SECURE MAC ON A SECURE PORT WITHOUT MANUALLY DELETING EXISTING MAC
                   • LIMIT MAC ADDRESS
                     • MAXIMUM NUMBER OF MAC ADDRESS
                       • S1 (CONFIG-IF)#SWITCHPORT PORT-SECURITY MAXIMUM VALUE
                       • DEFAULT PORT SECURITY VALUE IS 1
                       • DEPENDS THE SWITCH AND THE IOS
                   • PORT SECURITY MAC LEARNING METHODS
                     • DYNAMICALLY LEARN
                       • WHEN THE SWITCPORT PORT-SECURITY IS ENTERED
                         • IF THE SWITCH IS REBOOTED ?
                           • THE PORT WILL HAVE TO RE-LEARN
                           • SAVE ?
                             • RAM
                         • THE CURRENT SOURCE IS AUTOMATICALLY SECURED , BUT IS NOT ADDED TO THE STARTUP
                     • MANUALLY - STATIC
                       • S1(CONFIG-IF)# SWITCH PORT PORT-SECURITY MAC-ADDRESS
                     • DYNAMICALLY LEARNED - STICKY
                       • SAVE RUNNING CONFIGURATION WILL COMMIT TO NVRAM
                       • ENABLE SWITCH LEARN THE MAC ADDRESS AND "STICK" THE RUNNING CONFIGURATION
                         • S1(CONFIG-IF)# SWITCHPORT PORT-SECURITY MAC-ADRESS STICKY
               • (2) S1(CONFIG)#SWITCHPORT MODE ACCESS
           • HOW CAN IT BE VERIFIED?
             • S1#SHOW PORT-SECURITY INTERFACE F0/1
           • IF AN ACTIVE PORT IS CONFIGURED AND MORE ONE DEVICE IS CONNECTED TO THAT PORT ?
             • WILL TRANSITION ERROR-DISABLED STATE