With port security you can restrict, what device or how many devices can use this port.
Port-Sec Max devices -> I want to limit how many devices (mac addresses are allowed to plug in to a specific switch port.
To restore the port you have to shutdown the error-disabled port and then enable it again with “no shutdown”.
Configuring DHCP Snooping
You go through and label which ports are connected to DHCP servers. These are called your “trusted interfaces”.
As soon as you enable this feature, all offers are denied over the whole network except on the trusted interfaces.
Configuring DAI
DAI = dynamic ARP inspection
If a client wants to access a server, it first sends an ARP request. The secret server answers that ARP request with its MAC address.
Thanksto the table of “ip dhcp snooping bindings” the switch exactly knows who the ip of “Server 1” is. So if anyone else tries to answer that ARP request, it ignores that port.
So ip dhcp snooping has to be enabled for DAI to work.
Do NOT use DAI on:
- Trunks (Uplink ports)
- Static assigned ip addresses
Cisco IOS commands learned in this lesson
For switchport security
| Command | subcommand | Explanation |
| Switchport | port-security | Enables port-security on this port to default maximum mac-addresses is set to 1, and it’s the first one the switch learns. Security-action is shutdown->so if the port-security gets violated the port is going to shutdown (error-disabled). |
| Switchport port-security violation | Protect | If somebody violates the policy, it will not shutdown the interface and it won’t log the event. |
| Restrict | If somebody violates the policy, it will not shutdown the interface but it will log the event. | |
| shutdown | If somebody violates the policy, it will shutdown the interface and it will log the event. | |
| Switchport port-security | Aging | This is how long an address ages out. Best practis is to shutdown the unused ports. |
| Mac-address | Type your mac-address in this mac-address will be learned and is the only one allowed. This mac-addresses are in the running-config. So if the switch reboots, it has to learn the mac-addresses again. | |
| Mac-address sticky | When it learns the mac-address it will write it up into the startup-config. |
For DHCP Snooping
| Command | Subcommand | Explanation |
| ip dhcp snooping | Turns on DHCP snooping on that switch. | |
| ip dhcp snooping | Vlan X,Y,Z | activates DHCP snooping on for the specific VLANs. |
| Interface fastethernet X/Y | Going into interface config mode for the interface where is a DHCP server connected. | |
| Ip dhcp snooping trust | Trusts the interface, so therefore OFFER messages are allowed from this interface. | |
| ip dhcp snooping | Binding | You get a list where you can track which mac-address is tied to which ip address. |
For Dynamic ARP inspection
| Command | Subcommand | Explanation |
| Ip | Arp inspection vlan 10,20 | Activates DAI for vlan 10 and20 |
| Ip | Arp inspection trust | Excempt the actual settings. But plan this!! Any Arp response which is NOT in the dhcp binding table will be ignored! |
| Show ip | Arp inspection interfaces | Shows the interfaces and its status (trusted or untrusted) |
| Show ip | Arp inspection | Shows the settings and VLANs configured for DAI |
| Ip Arp inspection validate | Dst-mac | Not on by default, if somebody replies to you and the message is not from a message you requested, it will block that as well |
| Ip | On by default, make sure the source mac-address aligns with the ip address in the ARP message | |
| Src-mac | On by default, make sure the source mac-address aligns with the ip address in the ARP message |