SWITCHPORT PORT-SECURITY : Lock Down Security on Cisco Switches

Hello everyone, its been ages since I have posted on this blog. Sorry!! Mainly because, my focus shifted from Security to Networking, because I realized I gotta master Networking first to be a Security Professional. So, I have cleared CCNA, CCNA Security, CCNP ROUTE in the meanwhile and I am currently studying for CCNP SWITCH right now.
I wish to share an awesome feature of Cisco Switches - SwitchPort Security.

NEED ::

Wireless Networking has changed the face of the Switch Security. Until now, we believed that the only way to break into the network was through the Internet. Because the Wireless Access Points defaults to no security and allow anyone to connect to the Enterprise Network, SwitchPort Security was essential to limit who can and who cannot connect to the Switch Ports and access the Network.

A growing challenge facing network administrators is determining how to control who can access the organization’s internal network — and who can’t. For example, can anyone walk into your office, plug in a laptop, and access your network? Moreover, in today's network, needless to say, you donot trust each of your employees. And if none of the above two scenarios is correct, it may be an infected PC that is generating a broadcast storm or generating frames from thousand different MAC addresses to populate Switch's CAM (Content Addressable Memory) table and turn the Switch into a miserable Hub.

Understand the basics

In its most basic form, the Port Security feature remembers the Ethernet MAC address connected to the switch port and allows only that MAC address to communicate on that port. If any other MAC address tries to communicate through the port, port security will take an action configured by you, which is either ignoring the packet from unknown MAC address or disabling the port. Most of the time, network administrators configure the switch to send a SNMP trap to their network monitoring solution that the port’s disabled for security reasons.

Of course, implementing any security solution always involves a trade-off — most often, you trade increased security for less convenience. When using port security, you can prevent devices from accessing the network, which increases security.

Configure port security

Configuring the Port Security feature is relatively easy. In its simplest form, port security requires going to an already enabled switch port and entering the port-security Interface Mode command. Here’s an example:

Switch)# config t
Switch(config)# int fa0/18
Switch(config-if)# switchport port-security ?
aging           Port-security aging commands
mac-address     Secure mac address
maximum         Max secure addresses
violation       Security violation mode

Switch(config-if)# switchport port-security
Switch(config-if)#^Z

By entering the most basic command to configure port security, we accepted the default settings of only allowing one MAC address, determining that MAC address from the first device that communicates on this switch port, and shutting down that switch port if another MAC address attempts to communicate via the port. But you don’t have to accept the defaults.

Know your options

As you can see in the example, there are a number of other port security commands that you can configure. Here are some of your options:

• switchport port-security maximum {max # of MAC addresses allowed}: You can use this option to allow more than the default number of MAC addresses, which is one. For example, if you had a 12-port hub connected to this switch port, you would want to allow 12 MAC addresses — one for each device. The maximum number of secure MAC addresses per port is 132.



• switchport port-security violation {shutdown | restrict | protect}: This command tells the switch what to do when the number of MAC addresses on the port has exceeded the maximum. The default is to shut down the port. However, you can also choose to alert the network administrator (i.e., restrict) or only allow traffic from the secure port and drop packets from other unknown MAC addresses (i.e., protect).


• switchport port-security mac-address {MAC address}: You can use this option to manually define the MAC address allowed for this port rather than letting the port dynamically determine the MAC address.

Of course, you can also configure port security on a range of ports. Here’s an example:

Switch)# config t
Switch(config)# int range fastEthernet 0/1 - 24
Switch(config-if)# switchport port-security

However, you need to be very careful with this option if you enter this command on an uplink port that goes to more than one device. As soon as the second device sends a packet, the entire port will shut down.

View the status of port security

Once you’ve configured port security and the Ethernet device on that port has sent traffic, the switch will record the MAC address and secure the port using that address. To find out the status of port security on the switch, you can use the show port-security address and show port-security interface commands. Below are examples for each command’s output:

Switch# show port-security address
      Secure Mac Address Table
-------------------------------------------------------------------
Vlan    Mac Address       Type                Ports   Remaining Age
                                                     (mins)
----    -----------       ----                -----   -------------
1    0004.00d5.285d    SecureDynamic       Fa0/18       -
-------------------------------------------------------------------
Total Addresses in System (excluding one mac per port)     : 0
Max Addresses limit in System (excluding one mac per port) : 1024

Switch# show port-security interface fa0/18
Port Security                        : Enabled
Port Status                          : Secure-up
Violation Mode                       : Shutdown
Aging Time                           : 0 mins
Aging Type                           : Absolute
SecureStatic Address Aging           : Disabled
Maximum MAC Addresses                : 1
Total MAC Addresses                  : 1
Configured MAC Addresses             : 0
Sticky MAC Addresses                 : 0
Last Source Address                  : 0004.00d5.285d
Security Violation Count             : 0

Switch#

For more information on switch port commands and configuring the Port Security feature, check out Cisco’s Enabling Port Security documentation for the Catalyst 2950. What steps have you taken to lock down switch port security? Share your tips in this article’s discussion.

Extensible Authentication Protocol (EAP)

What is Extensible Authentication Protocol (EAP)?

The Extensible Authentication Protocol (EAP) is a general protocol for PPP and wireless authentication which supports multiple authentication mechanisms. Microsoft Windows uses EAP to authenticate Point-to-Point Protocol (PPP)-based connections (such as dial-up, virtual private network remote access, and site-to-site connections) and for IEEE 802.1X-based network access to authenticating Ethernet switches and wireless access points (APs).

EAP begins as the authenticator sends one or more Requests to authenticate the peer. The three devices involved in the 802.1x authentication are the client, an authentication server and Wireless Access Point (WAP). The user or client that wants to be authenticated is called a supplicant. The actual server doing the authentication, typically a RADIUS server, is called the authentication server. And the device in between, such as a wireless access point, is called the authenticator. The Request has a type field to indicate what is being requested. Examples of Request types include Identity, MD5-challenge, One-Time Passwords, Generic Token Card, etc. The peer sends a Response packet in reply to each Reques and the authenticator ends the authentication phase with a Success or Failure packet. This may look very simple but complexity resides in authenticating using the various methods such as EAP-PSK (Pre Shared Keys), EAP-MD5 (MD5 hashing), EAP-TLS(Transport Layer Security).

EAP Methods for Different Types of Network Access
The following table lists the different types of access and the available EAP methods you can use in Microsoft Windows. Microsoft Windows has its own proprietary MS-CHAPv2 authentication also method which provides secure authentication between devices.

Type of Network Access	Available EAP Methods
Dial-up remote access or site-to-site connections	EAP-MD5 CHAP, EAP-TLS
Virtual private network remote access connections	EAP-MD5 CHAP, EAP-TLS, PEAP-MS-CHAP v2, PEAP-TLS
Virtual private network site-to-site connections	EAP-MD5 CHAP, EAP-TLS
802.1X authentication to an authenticating switch (wired)	EAP-MD5 CHAP, PEAP-MS-CHAP v2, EAP-TLS, PEAP-TLS
802.1X authentication to a wireless AP	PEAP-MS-CHAP v2, EAP-TLS, PEAP-TLS

802.1x

I was trying to dig deeper into the Wireless Security Standards - WEP & WPA, when I read about 802.1x and I was blown by its widespread use and the research work put behind the framing of the standard.

WEP had many security flaws such as static preshared keys, which could be easily cracked. So Cisco came out with its interim solution for Wi-Fi security in its devices which used dynamic key exchange, a new encrption key for each packet and authentication using IEEE 802.1x. Extensible Authentication Protocol (EAP) authentication is now used in WPA and WPA2 for 802.11.

IEEE 802.1x standard is simply a standard for passing EAP over a wired or wireless LAN. With 802.1x, you package EAP messages in Ethernet frames and don't use PPP. It's authentication and nothing more. That's desirable in situations in which the rest of PPP isn't needed, where you're using protocols other than TCP/IP, or where the overhead and complexity of using PPP is undesirable.

The three devices involved in the 802.1x authentication are the client, an authentication server and Wireless Access Point (WAP). The user or client that wants to be authenticated is called a supplicant. The actual server doing the authentication, typically a RADIUS server, is called the authentication server. And the device in between, such as a wireless access point, is called the authenticator. One of the key points of 802.1x is that the authenticator can be simple and dumb - all of the brains have to be in the supplicant and the authentication server. This makes 802.1x ideal for wireless access points, which are typically small and have little memory and processing power.