9.2 Port Security Explained
Key Concepts of Port Security
Port Security is a feature used to protect network switches by limiting the number of MAC addresses that can be learned on a specific port. Key concepts include:
- MAC Address Learning: The process by which a switch learns the MAC addresses of devices connected to its ports.
- Maximum MAC Addresses: The maximum number of MAC addresses that a port can learn.
- Violation Mode: The action taken by the switch when a port exceeds the maximum number of allowed MAC addresses.
- Secure MAC Addresses: The list of MAC addresses that are allowed to communicate through a secure port.
- Static and Dynamic MAC Addresses: Static MAC addresses are manually configured, while dynamic MAC addresses are learned by the switch.
MAC Address Learning
MAC Address Learning is the process by which a switch learns the MAC addresses of devices connected to its ports. When a device sends a frame, the switch records the source MAC address and the port number in its MAC address table. This allows the switch to forward frames only to the appropriate port.
Example: When a PC with MAC address 00:1A:2B:3C:4D:5E sends a frame, the switch learns this MAC address and associates it with the port to which the PC is connected. The next time the switch receives a frame destined for 00:1A:2B:3C:4D:5E, it forwards the frame only to that port.
Maximum MAC Addresses
Maximum MAC Addresses refers to the maximum number of MAC addresses that a port can learn. This limit helps prevent unauthorized devices from connecting to the network through that port. Exceeding this limit triggers a violation mode action.
Example: If a port is configured to learn a maximum of 3 MAC addresses, and a fourth device attempts to connect, the switch will take action based on the configured violation mode.
Violation Mode
Violation Mode defines the action taken by the switch when a port exceeds the maximum number of allowed MAC addresses. Common violation modes include:
- Shutdown: The port is disabled and placed in an error-disabled state.
- Restrict: The port continues to operate but drops packets from unauthorized MAC addresses.
- Protect: The port continues to operate but silently drops packets from unauthorized MAC addresses without generating an error.
Example: If a port is configured with a violation mode of "Shutdown" and it exceeds the maximum number of MAC addresses, the port will be disabled, and an administrator will need to manually re-enable it.
Secure MAC Addresses
Secure MAC Addresses are the list of MAC addresses that are allowed to communicate through a secure port. Only devices with MAC addresses in this list can send and receive traffic through the port. This helps prevent unauthorized devices from accessing the network.
Example: A switch port is configured with secure MAC addresses 00:1A:2B:3C:4D:5E and 00:2A:3B:4C:5D:6E. Only devices with these MAC addresses can communicate through the port. Any other device attempting to connect will be denied access.
Static and Dynamic MAC Addresses
Static MAC addresses are manually configured on the switch, while dynamic MAC addresses are learned by the switch. Static MAC addresses are typically used for critical devices that should always have access, while dynamic MAC addresses are used for devices that connect and disconnect frequently.
Example: A server with a static MAC address 00:1A:2B:3C:4D:5E is configured on a switch port. This ensures that the server always has access to the network. Other devices, such as PCs, will have their MAC addresses dynamically learned by the switch as they connect.