topic Re: Port-security in Network Security

Port-security

M.Sultan — Sat, 30 Dec 2023 22:07:12 GMT

Dear guys,

#inter fast 0/2
#switchport mode access
#switchport port-security violation shutdown
#switchport port-security maximum 1
#switchport port-security mac-address sticky
#swtichport port-security aging type absolute
#switchport port-security aging time 1
#switchport port-security
#do wr

I configured port security for interface fast0/2 on switch, according to the aging type and time after 1 minute the switchport must error disable the port and drop the traffic,but nothing happens, please help to resolve it.

Best wishes

Sultan

Re: Port-security

MHM Cisco World — Sat, 30 Dec 2023 22:06:38 GMT

Why errdisable

After 1 min and using aging (you need to add static since you use sticky) the port relearn the mac not go to errdisable

MHM

Re: Port-security

M02@rt37 — Sat, 30 Dec 2023 22:11:08 GMT

Hello @M.Sultan

What is plug on that Fa0/2 ? Have you got in the log the mac address associated to that port-security interface ?

Re: Port-security

M.Sultan — Sat, 30 Dec 2023 22:52:19 GMT

Aging time cause i want to give access to a guest via the switch, so i define 1 minute time limit afterr 1 minute the switchport must go error disable.

Aging type is Absolute!

Re: Port-security

balaji.bandi — Sat, 30 Dec 2023 23:04:57 GMT

yes only if the device or MAC changed - what are you expecting here ?

take example :

ORGINAL MAC address :

SW1#show port-security interface ethernet 0/0
Port Security : Enabled
Port Status : Secure-up
Violation Mode : Shutdown
Aging Time : 1 mins
Aging Type : Absolute
SecureStatic Address Aging : Disabled
Maximum MAC Addresses : 1
Total MAC Addresses : 1
Configured MAC Addresses : 0
Sticky MAC Addresses : 1
Last Source Address:Vlan : aabb.cc00.0700:100
Security Violation Count : 0

I have connected different devices :

you get message due to MAC changed on the ports :

%PORT_SECURITY-2-PSECURE_VIOLATION: Security violation occurred, caused by MAC address 3a83.af75.7d84 on port Ethernet0/0

you see violation count 1 :

SW1#show port-security
Secure Port MaxSecureAddr CurrentAddr SecurityViolation Security Action
(Count) (Count) (Count)
---------------------------------------------------------------------------
Et0/0 1 1 1 Shutdown
---------------------------------------------------------------------------

SW1#show port-security interface ethernet 0/0
Port Security : Enabled
Port Status : Secure-shutdown
Violation Mode : Shutdown
Aging Time : 1 mins
Aging Type : Absolute
SecureStatic Address Aging : Disabled
Maximum MAC Addresses : 1
Total MAC Addresses : 1
Configured MAC Addresses : 0
Sticky MAC Addresses : 1
Last Source Address:Vlan : 3a83.af75.7d84:100
Security Violation Count : 1

SW1#show interfaces status err-disabled (because i try to connect different device - since the MAC changed)

Port Name Status Reason Err-disabled Vlans
Et0/0 err-disabled psecure-violation

Re: Port-security

MHM Cisco World — Sat, 30 Dec 2023 23:04:34 GMT

Even if it absolute' the aging will make SW remove mac from port and learn new one.

You want after specific time the host disconnect I think you can not do that with port secuirty you need 802.1x for this task

MHM

Re: Port-security

M.Sultan — Sat, 30 Dec 2023 23:08:06 GMT

I read from Cisco book there i two aging type : Absolute and inactivity, once one of these configure along with specific time the port must counter to error-disable. regardless of changing mac from that port. !!!

Re: Port-security

MHM Cisco World — Sat, 30 Dec 2023 23:10:44 GMT

Can you share the cisco book name' let me check it

MHM

Re: Port-security

M.Sultan — Sat, 30 Dec 2023 23:11:17 GMT

That's correct i understand my point is with (Aging type and the aging time i configured with int fas0/3)

Two types : Absolute and Inactivity

#switchport port-security aging type absolute
#switchport port-security aging time 1

Absolutely the port must go to error-disable after 1 minute its what really the Cisco topics says.

Re: Port-security

M.Sultan — Sat, 30 Dec 2023 23:14:01 GMT

Re: Port-security

M.Sultan — Sat, 30 Dec 2023 23:21:14 GMT

31 Days before your CCNA exam Book.

Re: Port-security

MHM Cisco World — Sat, 30 Dec 2023 23:25:31 GMT

Yes friend'

I read the page and as I mention before it talk about remove mac from table and make port learn new mac.

There is no mention about errdisable.

MHM

Re: Port-security

balaji.bandi — Sat, 30 Dec 2023 23:31:18 GMT

There are different things here -

since you added :

#switchport port-security mac-address sticky

First device with MAC connected that port will become stick MAC you can check show run interface x/x ( you see the MAC address added to that configuration)

what is the goal you trying to achieve is important

If you see different MAC address in 1 Min the port go in error disable.

But if the PC removed and the MAC will be flushed and any other device can be connected to that port.

again some improvements have done in new IOX XE on top of basic functionality of the security port :

You can also add errordisable recovery part of the global config.

Re: Port-security

M.Sultan — Sat, 30 Dec 2023 23:31:46 GMT

Exactly absolute and inactivity! once the mac is removed from the current secure address still i can communicate with other PC just it removed the mac from the current secured add nothing else. it seems very useless for or i am wrong.

Re: Port-security

MHM Cisco World — Sat, 30 Dec 2023 23:40:22 GMT

No it not useless'

You have SW and you config port secuirty' then your host pc is move and you are admin'

Without aging you need to shut/no shut port to make port learn new mac

With aging' after specific time the port clear mac and learn new mac without need from admin to shut/no shut port

MHM

Re: Port-security

M.Sultan — Sun, 31 Dec 2023 20:37:27 GMT

Switch#show port-security interface ethernet 0/3
Port Security : Enabled
Port Status : Secure-up
Violation Mode : Shutdown
Aging Time : 1 mins
Aging Type : Absolute
SecureStatic Address Aging : Disabled
Maximum MAC Addresses : 1
Total MAC Addresses : 1
Configured MAC Addresses : 1
Sticky MAC Addresses : 0
Last Source Address:Vlan : 0050.7966.68e7:1
Security Violation Count : 0

Right i manually added mac address to the port and after 1 mins switch must not try to relearn new mac address because its not sticky. I'm confused mate.

Re: Port-security

MHM Cisco World — Sun, 31 Dec 2023 23:25:29 GMT

swtichport port-security aging type absolute <- this for aging dynamic mac

But you config sticky (which is static mac) so you need

swtichport port-security aging static type absolute

MHM

Re: Port-security

M.Sultan — Sun, 31 Dec 2023 23:45:33 GMT

#int fast0/1
#switchport mode access
#switchport port-security violation shutdown
#switchport port-security maximum 1
#switchport port-security mac-address sticky
#switchport port-security aging type absolute
#switchport port-security aging time 1
#switchport port-security

By this config i expect the switch after 1 min release the sticky (dynamically learnt mac pc1) and learn the new mac from pc2.

but when i swap ports the interface counts error-disable.

I'm deeply confused with aging time how it works please simply explain and brief the out put to understand it.

Re: Port-security

MHM Cisco World — Mon, 01 Jan 2024 00:04:04 GMT

There are two type of mac in port secuirty

1- dynamic

2- static a- manual add mac to port b- sticky

So sticky is staitc not dynamic' it really dynamic learn mac but it add to port-secuirty as static mac.

Now port secuirty aging you need to specify static to make port secuirty aging static mac entry (via sticky)

***switchport port-security aging {static | time time | type {absolute | inactivity}}

MHM

Re: Port-security

balaji.bandi — Mon, 01 Jan 2024 11:05:41 GMT

May be better clarity of the use cases :

its all depends on IOS code you using, most case should be the same.

Configuring Secure MAC Address Aging on a Port

When the aging type is configured with the absolute keyword, all the dynamically learned secure addresses age out when the aging time expires. When the aging type is configured with the inactivity keyword, the aging time defines the period of inactivity after which all the dynamically learned secure addresses age out.

topic Re: Port-security in Network Security

Port-security

Re: Port-security

Re: Port-security

Re: Port-security

Re: Port-security

Re: Port-security

Re: Port-security

Re: Port-security

Re: Port-security

Re: Port-security

Re: Port-security

Re: Port-security

Re: Port-security

Re: Port-security

Re: Port-security

Re: Port-security

Re: Port-security

Re: Port-security

Re: Port-security

Re: Port-security

Configuring Secure MAC Address Aging on a Port

Note Static secure MAC addresses and sticky secure MAC addresses do not age out.