14.3.11 Packet Tracer - Implement Port Security Answers
14.3.11 Packet Tracer – Implement Port Security
Addressing Table
| Device | Interface | IP Address | Subnet Mask |
|---|---|---|---|
| S1 | VLAN 1 | 10.10.10.2 | 255.255.255.0 |
| PC1 | NIC | 10.10.10.10 | 255.255.255.0 |
| PC2 | NIC | 10.10.10.11 | 255.255.255.0 |
| Rogue Laptop | NIC | 10.10.10.12 | 255.255.255.0 |
Objective
- Part 1: Configure Port Security
- Part 2: Verify Port Security
Background
In this activity, you will configure and verify port security on a switch. Port security allows you to restrict a port’s ingress traffic by limiting the MAC addresses that are allowed to send traffic into the port.
Intructions
Part 1: Configure Port Security
a. Access the command line for S1 and enable port security on Fast Ethernet ports 0/1 and 0/2.
S1(config)# interface range f0/1 - 2 S1(config-if-range)# switchport port-security
b. Set the maximum so that only one device can access the Fast Ethernet ports 0/1 and 0/2.
S1(config-if-range)# switchport port-security maximum 1
c. Secure the ports so that the MAC address of a device is dynamically learned and added to the running configuration.
S1(config-if-range)# switchport port-security mac-address sticky
d. Set the violation mode so that the Fast Ethernet ports 0/1 and 0/2 are not disabled when a violation occurs, but a notification of the security violation is generated and packets from the unknown source are dropped.
S1(config-if-range)# switchport port-security violation restrict
e. Disable all the remaining unused ports. Use the range keyword to apply this configuration to all the ports simultaneously.
S1(config-if-range)# interface range f0/3 - 24, g0/1 - 2 S1(config-if-range)# shutdown
Part 2: Verify Port Security
a. From PC1, ping PC2.
b. Verify that port security is enabled and the MAC addresses of PC1 and PC2 were added to the running configuration.
S1# show run | begin interface
c. Use port-security show commands to display configuration information.
S1# show port-security S1# show port-security address
d. Attach Rogue Laptop to any unused switch port and notice that the link lights are red.
e. Enable the port and verify that Rogue Laptop can ping PC1 and PC2. After verification, shut down the port connected to Rogue Laptop.
f. Disconnect PC2 and connect Rogue Laptop to F0/2, which is the port to which PC2 was originally connected. Verify that Rogue Laptop is unable to ping PC1.
g. Display the port security violations for the port to which Rogue Laptop is connected.
S1# show port-security interface f0/2
Question
How many violations have occurred?
There should be a violation count of at least four, one for each ping request.
h. Disconnect Rouge Laptop and reconnect PC2. Verify PC2 can ping PC1.
Question
Why is PC2 able to ping PC1, but the Rouge Laptop is not?
The port security that was enabled on the port only allowed the device, whose MAC was learned first, access to the port while preventing all other devices access.
Device Configs - Final
Switch S1
! ============================================================== !--- 14.3.11 Packet Tracer - Implement Port Security !--- ANSWER SCRIPT FOR SWITCH S1 !--- Usage: copy this whole file and paste it into the S1 terminal (start at the S1> prompt). Every line beginning with "!" is a comment; IOS ignores it, so pasting a comment by accident is harmless. ! ============================================================== enable configure terminal ! -------------------------------------------------------------- !--- Part 1: Configure Port Security on F0/1 and F0/2. ! -------------------------------------------------------------- !--- Enable port security on the two access ports (F0/1, F0/2) where legitimate hosts PC1/PC2 connect. interface range fastethernet 0/1 - 2 switchport port-security !--- Allow only one MAC address per port. switchport port-security maximum 1 !--- Dynamically learn the connected device's MAC address and add it to the running configuration (sticky). switchport port-security mac-address sticky !--- On a violation, drop traffic from the unknown source and log it, without error-disabling the port. switchport port-security violation restrict exit ! -------------------------------------------------------------- !--- Part 2: Disable All Remaining Unused Ports. ! -------------------------------------------------------------- !--- Shut down every other port on the switch so an unused port can't be used to gain unauthorized access. interface range fastethernet 0/3 - 24, gigabitethernet 0/1 - 2 shutdown exit end ! -------------------------------------------------------------- !--- Save the configuration to NVRAM. (Press Enter when prompted for the destination filename.) ! -------------------------------------------------------------- copy running-config startup-config ! ============================================================== !--- Verification: !--- show run | begin interface -> confirms port-security config and the sticky-learned MAC addresses !--- for PC1/PC2 appear as "switchport port-security mac-address sticky" !--- show port-security -> confirms F0/1/F0/2 status Secure-up, max 1, violation mode Restrict !--- show port-security address -> confirms the two learned MAC addresses and their ports !--- show port-security interface f0/2 -> confirms SecurityViolation count increments when the Rogue !--- Laptop is connected to F0/2 and tries to send traffic !--- Note: violation mode is "restrict," not "shutdown" or "protect" — the port stays up and forwards !--- traffic from the already-learned MAC, but silently drops frames from any other source MAC and logs !--- a violation (and increments the counter) each time one arrives — this is why the Rogue Laptop's pings !--- fail without taking the port down, matching Part 2's expected behavior. ! ==============================================================
