11.6.1 Packet Tracer – Switch Security Configuration

11.6.1 Packet Tracer - Switch Security Configuration (Instructor Version)

Topology

VLAN Table

Switch	VLAN Number	VLAN Name	Port Membership	Network
SW-1	10	Admin	F0/1, F0/2	192.168.10.0/24
	20	Sales	F0/10	192.168.20.0/24
	99	Management	F0/24	192.168.99.0/24
	100	Native	G0/1, G0/2	None
	999	BlackHole	All unused	None
SW-2	10	Admin	F0/1, F0/2	192.168.10.0/24
	20	Sales	F0/10	192.168.20.0/24
	99	Management	F0/24	192.168.99.0/24
	100	Native	None	None
	999	BlackHole	All unused	None

Objectives

Part 1: Create a Secure Trunk
Part 2: Secure Unused Switchports
Part 3: Implement Port Security
Part 4: Enable DHCP Snooping
Part 5: Configure Rapid PVST PortFast and BPDU Guard

Background

You are enhancing security on two access switches in a partially configured network. You will implement the range of security measures that were covered in this module according to the requirements below. Note that routing has been configured on this network, so connectivity between hosts on different VLANs should function when completed.

Instructions

Step 1: Create a Secure Trunk.

a. Connect the G0/2 ports of the two access layer switches.

b. Configure ports G0/1 and G0/2 as static trunks on both switches.

c. Disable DTP negotiation on both sides of the link.

d. Create VLAN 100 and give it the name Native on both switches.

e. Configure all trunk ports on both switches to use VLAN 100 as the native VLAN.

SW-1 and SW-2

SW-1/SW-2(config)#interface range GigabitEthernet0/1 - 2
SW-1/SW-2(config-if-range)#switchport mode trunk
SW-1/SW-2(config-if-range)#switchport nonegotiate
SW-1/SW-2(config-if-range)#
SW-1/SW-2(config-if-range)#vlan 100
SW-1/SW-2(config-vlan)#name Native
SW-1/SW-2(config-vlan)#
SW-1/SW-2(config-vlan)#interface range GigabitEthernet0/1 - 2
SW-1/SW-2(config-if-range)#switchport trunk native vlan 100

Step 2: Secure Unused Switchports.

a. Shutdown all unused switch ports on SW-1.

b. On SW-1, create a VLAN 999 and name it BlackHole. The configured name must match the requirement exactly.

c. Move all unused switch ports to the BlackHole VLAN.

SW-1(config)#interface range FastEthernet0/3-9, FastEthernet0/11-23
SW-1(config-if-range)#shutdown
SW-1(config-if-range)#exit

SW-1(config)#vlan 999
SW-1(config-vlan)#name BlackHole
SW-1(config-vlan)#exit

SW-1(config)#interface range FastEthernet0/3-9, FastEthernet0/11-23
SW-1(config-if-range)#switchport access vlan 999

Step 3: Implement Port Security.

a. Activate port security on all the active access ports on switch SW-1.

SW-1(config)#interface range FastEthernet0/1, FastEthernet0/2, FastEthernet0/10,FastEthernet0/24
SW-1(config-if-range)#switchport mode access
SW-1(config-if-range)#switchport port-security

b. Configure the active ports to allow a maximum of 4 MAC addresses to be learned on the ports.

SW-1(config)#interface range FastEthernet0/1, FastEthernet0/2, FastEthernet0/10,FastEthernet0/24
SW-1(config-if-range)#switchport port-security maximum 4

c. For ports F0/1 on SW-1, statically configure the MAC address of the PC using port security.

SW-1(config)#interface FastEthernet0/1
SW-1(config-if)#switchport port-security mac-address 0010.11E8.3CBB

Show MAC address on PC1:
a. Click PC1 and open the Command Prompt.
b. Enter the ipconfig /all command to collect MAC address information.

d. Configure each active access port so that it will automatically add the MAC addresses learned on the port to the running configuration.

SW-1(config)#interface range FastEthernet0/1, FastEthernet0/2, FastEthernet0/10,FastEthernet0/24
SW-1(config-if-range)#switchport port-security mac-address sticky

e. Configure the port security violation mode to drop packets from MAC addresses that exceed the maximum, generate a Syslog entry, but not disable the ports.

SW-1(config)#interface range FastEthernet0/1, FastEthernet0/2, FastEthernet0/10,FastEthernet0/24
SW-1(config-if-range)#switchport port-security violation restrict

Step 4: Configure DHCP Snooping.

a. Configure the trunk ports on SW-1 as trusted ports.

SW-1(config)#interface range GigabitEthernet0/1-2
SW-1(config-if-range)#ip dhcp snooping trust

b. Limit the untrusted ports on SW-1 to five DHCP packets per second.

SW-1(config)#interface range FastEthernet0/2, FastEthernet0/10,FastEthernet0/24
SW-1(config-if-range)#ip dhcp snooping limit rate 5

c. On SW-2, enable DHCP snooping globally and for VLANs 10, 20 and 99.

SW-2(config)#ip dhcp snooping
SW-2(config)#ip dhcp snooping vlan 10,20,99

Note: The DHCP snooping configuration may not score properly in Packet Tracer.

Step 5: Configure PortFast, and BPDU Guard.

a. Enable PortFast on all the access ports that are in use on SW-1.
b. Enable BPDU Guard on all the access ports that are in use on SW-1.

SW-1(config)#interface range FastEthernet0/1-2, FastEthernet0/10,FastEthernet0/24
SW-1(config-if-range)#spanning-tree portfast
SW-1(config-if-range)#spanning-tree bpduguard enable

c. Configure SW-2 so that all access ports will use PortFast by default.

SW-2(config)#spanning-tree portfast default

Device Configs - Final

SW1 Configurations

! ==============================================================
!--- 11.6.1 Packet Tracer - Switch Security Configuration
!--- ANSWER SCRIPT FOR SWITCH SW-1
!--- Usage: from the console (or a Telnet/SSH session, if already reachable) on SW-1, enter privileged EXEC mode with "enable", then paste this whole file. Every line beginning with "!" is a comment; IOS ignores it, so pasting a comment by accident is harmless. SW-1 is described as "partially configured" already (VLANs 10/20/99 and their access ports, IP addressing, routing) - this script only adds the security hardening this lab actually asks for.
!--- IMPORTANT: the static MAC address below (0010.11E8.3CBB) for F0/1 is a placeholder from the source document - replace it with the ACTUAL MAC address of the PC connected to F0/1 in your own topology (check the PC's NIC config, or let F0/1 dynamically learn it once via "show mac address-table" and convert that entry to a static one).
! ==============================================================

enable
configure terminal

! --------------------------------------------------------------
!--- Part 1: Create a secure trunk (link to SW-2 via G0/1 and G0/2)
! --------------------------------------------------------------

!--- Both uplinks become static trunks with DTP switched off ("nonegotiate") and VLAN 100 as the renamed native VLAN.
interface range GigabitEthernet0/1 - 2
 switchport mode trunk
 switchport trunk native vlan 100
 switchport nonegotiate
 ip dhcp snooping trust

vlan 100
 name Native

! --------------------------------------------------------------
!--- Part 2: Secure unused switchports
! --------------------------------------------------------------

!--- Every FastEthernet port except the four actually in use (F0/1, F0/2, F0/10, F0/24) gets parked in a dedicated, unrouted VLAN and shut down.
vlan 999
 name BlackHole

interface range FastEthernet0/3 - 9, FastEthernet0/11 - 23
 switchport access vlan 999
 shutdown

! --------------------------------------------------------------
!--- Part 3: Implement port security on the active access ports
! --------------------------------------------------------------

!--- F0/1 gets a statically-configured secure MAC on top of the shared settings (max 4, sticky learning for the rest, "restrict" violation mode - drop + log, but never err-disable the port, matching the Instructions' exact wording).
interface FastEthernet0/1
 switchport mode access
 switchport port-security
 switchport port-security maximum 4
 switchport port-security violation restrict
 switchport port-security mac-address sticky
 switchport port-security mac-address 0010.11E8.3CBB

interface range FastEthernet0/2, FastEthernet0/10, FastEthernet0/24
 switchport mode access
 switchport port-security
 switchport port-security maximum 4
 switchport port-security violation restrict
 switchport port-security mac-address sticky

! --------------------------------------------------------------
!--- Part 4: DHCP snooping (rate-limit the untrusted access ports)
! --------------------------------------------------------------

!--- The trunk ports were already marked trusted in Part 1 above. This assumes DHCP snooping is already globally enabled on SW-1 from the network's existing baseline - the Instructions only explicitly ask to enable it globally on SW-2 (see the discrepancy note in chat), so that isn't repeated here.
interface FastEthernet0/1
 ip dhcp snooping limit rate 5

interface range FastEthernet0/2, FastEthernet0/10, FastEthernet0/24
 ip dhcp snooping limit rate 5

! --------------------------------------------------------------
!--- Part 5: PortFast and BPDU Guard on the active access ports
! --------------------------------------------------------------

!--- Per-interface, NOT the global "spanning-tree portfast default" - that global shortcut is only asked for on SW-2 (see the discrepancy note in chat); SW-1 is meant to enable it port-by-port instead.
interface FastEthernet0/1
 spanning-tree portfast
 spanning-tree bpduguard enable

interface range FastEthernet0/2, FastEthernet0/10, FastEthernet0/24
 spanning-tree portfast
 spanning-tree bpduguard enable

end

! --------------------------------------------------------------
!--- Operational habit (not explicitly required by this lab): save to NVRAM. (Press Enter when prompted for the destination filename.)
! --------------------------------------------------------------
copy running-config startup-config

! ==============================================================
!--- Verification:
!---   SW-1# show interfaces trunk         -> G0/1, G0/2 trunking, native VLAN 100
!---   SW-1# show vlan brief               -> VLAN 999 (BlackHole) shows all 20 unused ports; VLAN 100 (Native) shows none
!---   SW-1# show port-security interface f0/1 -> MaxMACAddresses 4, Violation Mode Restrict, Sticky MAC + the static MAC both present
!---   SW-1# show ip dhcp snooping         -> G0/1, G0/2 trusted; F0/1/2/10/24 rate-limited to 5 pps
!---   SW-1# show spanning-tree interface f0/1 detail -> Port Fast enabled, BPDU Guard enabled
! ==============================================================

SW-2 Configuration

! ==============================================================
!--- 11.6.1 Packet Tracer - Switch Security Configuration
!--- ANSWER SCRIPT FOR SWITCH SW-2
!--- Usage: from the console (or a Telnet/SSH session, if already reachable) on SW-2, enter privileged EXEC mode with "enable", then paste this whole file. Every line beginning with "!" is a comment; IOS ignores it, so pasting a comment by accident is harmless. SW-2 is described as "partially configured" already (VLANs 10/20/99 and their access ports, IP addressing, routing) - this script only adds what this lab actually asks for on SW-2: the secure trunk, DHCP snooping (globally, unlike SW-1), and PortFast by default.
!--- Note: the VLAN Table lists VLAN 999 (BlackHole) for SW-2 too, but Part 2 (unused-port shutdown) and Part 3 (port security) are explicitly scoped to SW-1 ONLY throughout the Instructions - nothing asks SW-2 to blackhole its unused ports or enable port security, so neither is included here. See the discrepancy note in chat.
! ==============================================================

enable
configure terminal

! --------------------------------------------------------------
!--- Part 1: Create a secure trunk (link to SW-1 via G0/1 and G0/2)
! --------------------------------------------------------------

!--- Mirrors SW-1's trunk settings exactly - both ends must match on native VLAN and DTP state.
interface range GigabitEthernet0/1 - 2
 switchport mode trunk
 switchport trunk native vlan 100
 switchport nonegotiate

!--- The source answer script never actually creates VLAN 100 on SW-2 - without this, IOS auto-creates it under the generic default name (VLAN0100) instead of "Native" once the trunk commands reference it, which fails the Instructions' explicit "give it the name Native ... on both switches" requirement.
vlan 100
 name Native

! --------------------------------------------------------------
!--- Part 4: Enable DHCP snooping globally, for VLANs 10/20/99
! --------------------------------------------------------------

ip dhcp snooping
ip dhcp snooping vlan 10,20,99

! --------------------------------------------------------------
!--- Part 5: Enable PortFast by default on all access ports
! --------------------------------------------------------------

!--- Unlike SW-1 (per-interface), SW-2 is specifically asked for the global default here.
spanning-tree portfast default

end

! --------------------------------------------------------------
!--- Operational habit (not explicitly required by this lab): save to NVRAM. (Press Enter when prompted for the destination filename.)
! --------------------------------------------------------------
copy running-config startup-config

! ==============================================================
!--- Verification:
!---   SW-2# show interfaces trunk -> G0/1, G0/2 trunking, native VLAN 100
!---   SW-2# show vlan brief       -> VLAN 100 shows as "Native" (not the generic VLAN0100)
!---   SW-2# show ip dhcp snooping -> enabled, VLANs 10,20,99
!---   SW-2# show running-config | include spanning-tree portfast default -> present
! ==============================================================

Download Packet Tracer (.pka) file: