Port Security. Always seems like one of those things covered in Cisco exams, yet how many businesses actually use it? For those that aren’t implementing it, should they? Or is it too much of a headache?
So the concept of port security is fairly simple – We want to secure each individual switch port to a physical layer 2 MAC address, or at least limit how many unique MAC addresses might be learned on an individual port. The technology could be used to just limit the number of simultaneous devices on a port – by just setting a MAC threshold. Or we can also take it to the extreme and lock down each port to a hard-coded MAC address – which will never allow another device to connect. You might be thinking that the second method is absolutely ridiculous, but it really depends on the business needs.
First, let’s take brief look at the typical port security configuration and some of the options available.
SecureSwitch(config)# interface x/x ! Whichever interface we want to lock down
SecureSwitch(config-if)# switchport port-security max xx ! Max number of MAC addresses that can be learned
SecureSwitch(config-if)# switchport port-security violation xxxxx ! Choose to either restrict or shutdown the port (description below)
SecureSwitch(config-if)# switchport port-security ! This actually enables the port security configFairly straight-forward, right? We choose a port (or you could do a range) and set a few options. The default number of MAC addresses able to be learned on a port is 1, so it’s likely you’re going to want to change this – unless 1 is all you need. Port security can only be enabled on access ports, so 1 MAC address works in most cases – except where you have a PC daisy-chained off of an IP phone (in which case this will need to be set to 2 or 3).
Next we set our preferred violation action. This step is pretty important because it defines what happens when the port exceeds it’s MAC count. Restrict is the passive approach. If we have two PC’s plugged into a single access port (maybe using an unmanaged switch), then the second PC will just never be able to work as long as our max MAC limit is 1. The first PC to connect will be fine, and the switch will log a message and send an SNMP trap when the second MAC is picked up. Shutdown is the more forceful approach. Once that second MAC address turns up on the port, the switch puts the port in an err-disabled state – which shuts down the port to all traffic. This event is also logged and generates an SNMP trap – however the port will not come back online until an administrator manually re-enables it.
Now that we see a basic config, let’s take a look at a few different use cases for this feature. In one of my previous jobs, I worked as a network admin for a local government organization. Port security configuration in that environment was extremely strict. Each switchport was configured to permit only one MAC address, shutdown upon violation, and the switchport port-security mac-address sticky command was also used. This command takes the first MAC address learned on the port and commits it to the running configuration, which means that this MAC is essentially hard-coded to be the only MAC permitted on the port. So in this environment, a single PC was tied to a single port – nothing else could ever be plugged into that port without either shutting down the port or administrator intervention. In a government office, this was absolutely necessary because every device on the network needed to be tracked and personal devices were not permitted to be connected. We needed to know if anything was ever plugged in that wasn’t an authorized device – so manual intervention and investigation was a requirement.
In a more typical office environment – port security configurations can just be a good security practice without going overboard with it. We never want a user to plug in a rouge switch into our network without our knowledge, right? So maybe we assume each user has an IP phone and PC, and limit the port to 2 MAC addresses. In this case, we can go ahead and just set the port to restrict. We don’t want to prevent the user from working if a port violation occurs, nor do we want to spend time resetting the port for them – but we might still want to be notified, especially if it happens often. In addition, port security is an excellent way to secure ports public areas. For example, maybe we have an IP phone or kiosk PC in our lobby. These need access to the network, but we don’t want anyone to be able to unplug that device and gain access into our network. In cases like this, it would actually make sense to have the switch only permit access from that single MAC address.
Outside of the ‘practical’ use cases, there is also the strictly security side of things. I’ve touched on a few considerations already – but there are also certain types of attacks that can be defeated by port security. One of those would be exhausting the CAM table resources. A malicious person could use publicly available tools to spoof MAC addresses in the packets they send to the switch. Tools like this force the switch to learn hundreds of thousands of MAC addresses, which eventually will overload the CAM table. When a switch CAM table becomes full, the switch begins flooding packets out all interfaces. This is because the switch can no longer assign mappings between MAC addresses and the ports they originate from – so the switch has no choice but to flood everything and hope the correct recipient receives the data. For the attacker, this means they can run a packet capture on the port and collect information they wouldn’t have otherwise needed to. This scenario could be prevented by implementing port security, which could simply restrict the number of MAC addresses learned off of any individual interface.
Port security configuration can be implemented in a few different ways depending on your use case. Overall though, it can prove to be a useful way to help implement security controls on your network. What do you think about port security? Extremely useful or does it just get in the way? Comment below and tell me how you have implemented it!