11.6.1 Packet Tracer - Switch Security Configuration Answers
Topology
11.6.1 Packet Tracer – Switch Security Configuration
VLAN Table
| Switch | VLAN Number | VLAN Name | Port Membership | Network |
|---|---|---|---|---|
| SW-1 | 10 | Admin | F0/1, F0/2 | 192.168.10.0/24 |
| 20 | Sales | F0/10 | 192.168.20.0/24 | |
| 99 | Management | F0/24 | 192.168.99.0/24 | |
| 100 | Native | G0/1, G0/2 | None | |
| 999 | BlackHole | All unused | None | |
| SW-2 | 10 | Admin | F0/1, F0/2 | 192.168.10.0/24 |
| 20 | Sales | F0/10 | 192.168.20.0/24 | |
| 99 | Management | F0/24 | 192.168.99.0/24 | |
| 100 | Native | None | None | |
| 999 | BlackHole | All unused | None |
Objectives
- Part 1: Create a Secure Trunk
- Part 2: Secure Unused Switchports
- Part 3: Implement Port Security
- Part 4: Enable DHCP Snooping
- Part 5: Configure Rapid PVST PortFast and BPDU Guard
Background
You are enhancing security on two access switches in a partially configured network. You will implement the range of security measures that were covered in this module according to the requirements below. Note that routing has been configured on this network, so connectivity between hosts on different VLANs should function when completed.
Instructions
Part 1: Create a Secure Trunk
a. Connect the G0/2 ports of the two access layer switches.
b. Configure ports G0/1 and G0/2 as static trunks on both switches.
SW-1:
SW-1(config)# interface range gigabitethernet 0/1 - 2 SW-1(config-if-range)# switchport mode trunk
SW-2:
SW-2(config)# interface range gigabitethernet 0/1 - 2 SW-2(config-if-range)# switchport mode trunk
c. Disable DTP negotiation on both sides of the link.
SW-1:
SW-1(config-if-range)# switchport nonegotiate
SW-2:
SW-2(config-if-range)# switchport nonegotiate
d. Create VLAN 100 and give it the name Native on both switches.
SW-1:
SW-1(config)# vlan 100 SW-1(config-vlan)# name Native
SW-2:
SW-2(config)# vlan 100 SW-2(config-vlan)# name Native
e. Configure all trunk ports on both switches to use VLAN 100 as the native VLAN.
SW-1:
SW-1(config)# interface range gigabitethernet 0/1 - 2 SW-1(config-if-range)# switchport trunk native vlan 100
SW-2:
SW-2(config)# interface range gigabitethernet 0/1 - 2 SW-2(config-if-range)# switchport trunk native vlan 100
Part 2: Secure Unused Switchports
a. Shut down all unused switch ports on SW-1.
SW-1(config)# interface range fastethernet 0/3 - 9, fastethernet 0/11 - 23 SW-1(config-if-range)# shutdown
b. On SW-1, create a VLAN 999 and name it BlackHole. The configured name must match the requirement exactly.
SW-1(config)# vlan 999 SW-1(config-vlan)# name BlackHole
c. Move all unused switch ports to the BlackHole VLAN.
SW-1(config)# interface range fastethernet 0/3 - 9, fastethernet 0/11 - 23 SW-1(config-if-range)# switchport access vlan 999
Part 3: Implement Port Security
a. Activate port security on all the active access ports on switch SW-1.
SW-1(config)# interface range fastethernet 0/1 - 2, fastethernet 0/10, fastethernet 0/24 SW-1(config-if-range)# switchport mode access SW-1(config-if-range)# switchport port-security
b. Configure the active ports to allow a maximum of 4 MAC addresses to be learned on the ports.
SW-1(config)# interface range fastethernet 0/1 - 2, fastethernet 0/10, fastethernet 0/24 SW-1(config-if-range)# switchport port-security maximum 4
c. For port F0/1 on SW-1, statically configure the MAC address of the PC using port security.
SW-1(config)# interface fastethernet 0/1 SW-1(config-if)# switchport port-security mac-address 0010.11E8.3CBB
Show MAC address on PC1:
a. Click PC1 and open the Command Prompt.
b. Enter the ipconfig /all command to collect MAC address information.
C:\> ipconfig /all
FastEthernet0 Connection:(default port)
Connection-specific DNS Suffix..:
Physical Address................: 0010.11E8.3CBB
Link-local IPv6 Address.........: FE80::210:11FF:FEE8:3CBB
IPv6 Address....................: ::
IPv4 Address....................: 192.168.10.10
Subnet Mask.....................: 255.255.255.0
Default Gateway.................: ::
0.0.0.0
DHCP Servers....................: 0.0.0.0
DHCPv6 IAID.....................:
DHCPv6 Client DUID..............: 00-01-00-01-85-4B-31-40-00-10-11-E8-3C-BB
DNS Servers.....................: ::
0.0.0.0
Bluetooth Connection:
Connection-specific DNS Suffix..:
Physical Address................: 00E0.8FCB.CD2B
Link-local IPv6 Address.........: ::
IPv6 Address....................: ::
IPv4 Address....................: 0.0.0.0
Subnet Mask.....................: 0.0.0.0
Default Gateway.................: ::
0.0.0.0
DHCP Servers....................: 0.0.0.0
DHCPv6 IAID.....................:
DHCPv6 Client DUID..............: 00-01-00-01-85-4B-31-40-00-10-11-E8-3C-BB
DNS Servers.....................: ::
0.0.0.0
d. Configure each active access port so that it will automatically add the MAC addresses learned on the port to the running configuration.
SW-1(config)# interface range fastethernet 0/1 - 2, fastethernet 0/10, fastethernet 0/24 SW-1(config-if-range)# switchport port-security mac-address sticky
e. Configure the port security violation mode to drop packets from MAC addresses that exceed the maximum, generate a Syslog entry, but not disable the ports.
SW-1(config)# interface range fastethernet 0/1 - 2, fastethernet 0/10, fastethernet 0/24 SW-1(config-if-range)# switchport port-security violation restrict
Part 4: Enable DHCP Snooping
a. Configure the trunk ports on SW-1 as trusted ports.
SW-1(config)# interface range gigabitethernet 0/1 - 2 SW-1(config-if-range)# ip dhcp snooping trust
b. Limit the untrusted ports on SW-1 to five DHCP packets per second.
SW-1(config)# interface range fastethernet 0/1 - 2, fastethernet 0/10, fastethernet 0/24 SW-1(config-if-range)# ip dhcp snooping limit rate 5
c. On SW-2, enable DHCP snooping globally and for VLANs 10, 20 and 99.
SW-2(config)# ip dhcp snooping SW-2(config)# ip dhcp snooping vlan 10,20,99
Note: The DHCP snooping configuration may not score properly in Packet Tracer.
Part 5: Configure Rapid PVST PortFast and BPDU Guard
a. Enable PortFast on all the access ports that are in use on SW-1.
SW-1(config)# interface range fastethernet 0/1 - 2, fastethernet 0/10, fastethernet 0/24 SW-1(config-if-range)# spanning-tree portfast
b. Enable BPDU Guard on all the access ports that are in use on SW-1.
SW-1(config-if-range)# spanning-tree bpduguard enable
c. Configure SW-2 so that all access ports will use PortFast by default.
SW-2(config)# spanning-tree portfast default
Device Configs - Final
SWITCH SW-1
! ============================================================== !--- 11.6.1 Packet Tracer - Switch Security Configuration !--- ANSWER SCRIPT FOR SWITCH SW-1 !--- Usage: copy this whole file and paste it into the SW-1 terminal (start at the SW-1> prompt). Every line beginning with "!" is a comment; IOS ignores it, so pasting a comment by accident is harmless. ! ============================================================== enable configure terminal ! -------------------------------------------------------------- !--- Part 1: Create a Secure Trunk. ! -------------------------------------------------------------- !--- d. VLAN 100 named Native. vlan 100 name Native exit !--- b. G0/1-2 as static trunks; c. DTP disabled; e. VLAN 100 as the native VLAN. interface range gigabitethernet 0/1 - 2 switchport mode trunk switchport nonegotiate switchport trunk native vlan 100 exit ! -------------------------------------------------------------- !--- Part 2: Secure Unused Switchports. ! -------------------------------------------------------------- !--- b. VLAN 999 named BlackHole (exact name). vlan 999 name BlackHole exit !--- a. Shut down all unused ports; c. move them to VLAN 999. interface range fastethernet 0/3 - 9, fastethernet 0/11 - 23 switchport access vlan 999 shutdown exit ! -------------------------------------------------------------- !--- Part 3: Implement Port Security. ! -------------------------------------------------------------- !--- a. Port security on the active access ports; b. maximum 4 MAC addresses; d. sticky learning; e. violation mode restrict. interface range fastethernet 0/1 - 2, fastethernet 0/10, fastethernet 0/24 switchport mode access switchport port-security switchport port-security maximum 4 switchport port-security mac-address sticky switchport port-security violation restrict exit !--- c. Static secure MAC address of PC1 on F0/1 (check it with ipconfig /all on PC1). interface fastethernet 0/1 switchport port-security mac-address 0010.11E8.3CBB exit ! -------------------------------------------------------------- !--- Part 4: Enable DHCP Snooping. ! -------------------------------------------------------------- !--- a. The trunk ports are trusted. interface range gigabitethernet 0/1 - 2 ip dhcp snooping trust exit !--- b. Untrusted access ports are limited to 5 DHCP packets per second. interface range fastethernet 0/1 - 2, fastethernet 0/10, fastethernet 0/24 ip dhcp snooping limit rate 5 exit ! -------------------------------------------------------------- !--- Part 5: Configure Rapid PVST PortFast and BPDU Guard. ! -------------------------------------------------------------- !--- a. PortFast and b. BPDU Guard on the access ports in use. interface range fastethernet 0/1 - 2, fastethernet 0/10, fastethernet 0/24 spanning-tree portfast spanning-tree bpduguard enable exit end ! -------------------------------------------------------------- !--- Save the configuration to NVRAM. (Press Enter when prompted for the destination filename.) ! -------------------------------------------------------------- copy running-config startup-config ! ============================================================== !--- Verification: !--- show interfaces trunk -> Gig0/1, Gig0/2: on, 802.1q, trunking, native VLAN 100 !--- show vlan brief -> 100 Native, 999 BlackHole with the unused ports !--- show port-security -> Fa0/1, Fa0/2, Fa0/10, Fa0/24: MaxSecureAddr 4, Restrict ! ==============================================================
SWITCH SW-2
! ============================================================== !--- 11.6.1 Packet Tracer - Switch Security Configuration !--- ANSWER SCRIPT FOR SWITCH SW-2 !--- Usage: copy this whole file and paste it into the SW-2 terminal (start at the SW-2> prompt). Every line beginning with "!" is a comment; IOS ignores it, so pasting a comment by accident is harmless. ! ============================================================== enable configure terminal ! -------------------------------------------------------------- !--- Part 1: Create a Secure Trunk. ! -------------------------------------------------------------- !--- d. VLAN 100 named Native. vlan 100 name Native exit !--- b. G0/1-2 as static trunks; c. DTP disabled; e. VLAN 100 as the native VLAN. interface range gigabitethernet 0/1 - 2 switchport mode trunk switchport nonegotiate switchport trunk native vlan 100 exit ! -------------------------------------------------------------- !--- Part 4: Enable DHCP Snooping. ! -------------------------------------------------------------- !--- c. DHCP snooping enabled globally and for VLANs 10, 20 and 99. ip dhcp snooping ip dhcp snooping vlan 10,20,99 ! -------------------------------------------------------------- !--- Part 5: Configure Rapid PVST PortFast and BPDU Guard. ! -------------------------------------------------------------- !--- c. All access ports use PortFast by default. spanning-tree portfast default end ! -------------------------------------------------------------- !--- Save the configuration to NVRAM. (Press Enter when prompted for the destination filename.) ! -------------------------------------------------------------- copy running-config startup-config ! ============================================================== !--- Verification: !--- show interfaces trunk -> Gig0/1, Gig0/2: on, 802.1q, trunking, native VLAN 100 !--- show ip dhcp snooping -> DHCP snooping enabled on VLANs 10,20,99 !--- Note: Packet Tracer may not score the DHCP snooping configuration properly (see the lab note). ! ==============================================================
