WEBVTT 00:00.090 --> 00:07.080 It is critically important that we understand Mac address attacks, so let's get to work on it right 00:07.080 --> 00:08.790 now in a network. 00:09.390 --> 00:13.410 Well, here we are in a layer two topology. 00:13.410 --> 00:18.030 And what would happen if we went to this device? 00:18.480 --> 00:19.080 Think about it. 00:19.080 --> 00:27.600 If we went to that P.C. that's attached to this device and we went and we flooded the MAC address table. 00:27.840 --> 00:35.940 The MAC address table is also known by the name the cam, the content addressable memory on the switch. 00:36.300 --> 00:42.540 If the cam fills, it's finite in size by default, of course, by design it's that way. 00:42.870 --> 00:47.340 If it fills, then legitimate MAC addresses can't be learned. 00:47.580 --> 00:53.070 And when people are trying to communicate with those legitimate MAC addresses, the traffic will be 00:53.070 --> 00:58.020 flooded and therefore perhaps intercepted by the eavesdropper. 00:58.290 --> 01:00.420 So this is a terrible situation. 01:00.780 --> 01:08.010 What we can do is we can lock down with port security, the ports based on Mac address. 01:08.310 --> 01:12.960 So this is the legitimate Mac address of PC one. 01:13.290 --> 01:17.790 So what I'm going to do is I'm going to copy that to the clipboard now. 01:17.790 --> 01:23.910 I'm going to show the running configuration for the fast Ethernet interface 0/4. 01:24.090 --> 01:25.350 Yeah, that's right. 01:25.350 --> 01:30.240 We can't actually do show run interface on this simulator. 01:30.240 --> 01:31.890 I don't like that at all, but that's okay. 01:31.890 --> 01:35.490 I'll just go in and manually look at it's in its default configuration. 01:35.880 --> 01:36.420 All right. 01:36.420 --> 01:42.720 So we're going to go to that fast Ethernet zero, slash four, and we're going to put in place port 01:42.720 --> 01:43.500 security. 01:43.530 --> 01:44.190 Watch this. 01:44.430 --> 01:49.470 We're going to say switch port mode access. 01:49.470 --> 01:50.730 That's the first thing we're going to do. 01:50.760 --> 01:59.640 We're going to make sure we are in access sport mode and then we're going to say switch port, port 02:00.030 --> 02:03.360 security mode, shutdown. 02:03.360 --> 02:04.770 This is going to ensure. 02:05.070 --> 02:07.680 Yeah, I don't think it's mode. 02:07.680 --> 02:09.810 I think it's violation. 02:09.840 --> 02:10.530 There we go. 02:10.800 --> 02:11.550 Shutdown. 02:11.910 --> 02:16.680 So it's the violation command asset violation mode of shutdown. 02:17.190 --> 02:25.180 If there is a mac address that shows up on this interface, that isn't the one that we're going to secure 02:25.180 --> 02:28.650 it down, lock it down to, then this interface will shut down. 02:28.740 --> 02:32.190 What great security will then say switch port. 02:33.280 --> 02:33.940 Mac? 02:34.570 --> 02:35.860 No maximum. 02:37.160 --> 02:38.570 Come on, Anthony, you can do it. 02:38.720 --> 02:39.550 Switch port. 02:39.560 --> 02:42.680 Port security, maximum one. 02:42.950 --> 02:45.620 To say we only want one knock address. 02:46.070 --> 02:51.290 Then we're going to say switch port, port security Mac address and let's paste it in. 02:52.740 --> 02:58.380 So we are locking down this switch port to that Mac address. 02:58.980 --> 03:03.990 Now, last thing, we have to turn on the feature switch port, port security. 03:04.230 --> 03:08.190 Believe you me, that is very difficult to remember. 03:08.610 --> 03:11.370 You're going to set the violation mode. 03:11.700 --> 03:13.110 You're going to set the maximum. 03:13.380 --> 03:14.880 You're going to set the Mac address. 03:15.090 --> 03:16.710 And then you're going to be like, okay, I'm done. 03:17.100 --> 03:22.860 It's so easy to forget to turn on the feature and you don't want to turn on the feature until you've 03:22.860 --> 03:24.090 got all the parameters set. 03:24.390 --> 03:30.690 So the way I did it is the best practice recommendation, but it's easy to forget to turn on the feature. 03:31.080 --> 03:33.210 That's why I always verify. 03:33.450 --> 03:38.850 So I will do a show Port Security Command, to make sure it's set properly. 03:39.030 --> 03:46.560 And let me just expand this so you can see it better in formatted view there, where fast Ethernet 0/4 03:46.560 --> 03:49.590 is set for one secure MAC address. 03:49.800 --> 03:56.490 Currently there is one address on the interface and it is the exact address of PC one. 03:56.700 --> 03:58.650 And what would happen if there's a violation? 03:58.800 --> 04:01.860 Well, this device would shut down this interface. 04:02.430 --> 04:04.620 Hey, let's test port security. 04:04.620 --> 04:11.730 Why don't we if we come over to this machine and we go to the. 04:12.180 --> 04:13.960 Would it be under IP properties? 04:13.980 --> 04:14.490 Yes. 04:14.490 --> 04:14.890 Look at the. 04:15.090 --> 04:16.140 No, that's the link. 04:16.140 --> 04:17.760 Local IPV six address. 04:17.760 --> 04:21.450 I got all excited, I saw the hacks and I thought that was the Mac address. 04:21.450 --> 04:21.720 Knew. 04:21.810 --> 04:23.520 That's the IPV six address. 04:24.030 --> 04:24.990 All right. 04:25.110 --> 04:27.190 Oh, we're getting close here. 04:27.190 --> 04:28.140 And we're getting close. 04:28.150 --> 04:28.780 Look at this. 04:28.800 --> 04:30.140 There's the Mac address. 04:30.150 --> 04:37.800 So we are going to change the Mac address now on this host and that should trigger a port security violation. 04:37.800 --> 04:38.670 And look at that. 04:39.390 --> 04:41.490 That interface just shut down. 04:41.490 --> 04:43.860 You can see I tested this earlier over here. 04:44.130 --> 04:44.430 Yeah. 04:44.670 --> 04:46.950 So that interface just shut down. 04:47.070 --> 04:47.760 Wow. 04:47.790 --> 04:49.860 We had a port security violation. 04:50.160 --> 04:51.090 And look at this. 04:51.390 --> 04:59.820 If we go to the device, we can see that there is the interface taken down. 05:00.420 --> 05:03.180 Let's see if we missed any log messages. 05:03.390 --> 05:03.720 Nope. 05:04.230 --> 05:13.350 So that is not realistic to the port security feature because there would have been absolutely a ton 05:13.830 --> 05:17.400 of log messages associated with that event. 05:19.890 --> 05:22.920 Show log buffer? 05:23.700 --> 05:23.870 No. 05:24.030 --> 05:24.390 All right. 05:24.540 --> 05:32.370 So anyways, yeah, we would have seen the port security violation messages right at the console. 05:32.430 --> 05:33.030 Trust me. 05:33.330 --> 05:40.530 But we saw the security feature doing its job and we should verify it with show port security? 05:40.710 --> 05:41.250 Yes. 05:41.280 --> 05:44.220 Now we can see there is a security violation. 05:44.640 --> 05:47.910 Hey, I wonder if it's smart enough to bring itself back up. 05:48.060 --> 05:48.720 Let's check it. 05:49.110 --> 05:58.050 So we will go in and we will change the Mac address back to the correct Mac, and that will start showing 05:58.050 --> 05:59.160 up on the interface. 05:59.880 --> 06:02.760 And let's see what happens. 06:02.830 --> 06:04.350 Let's do a show. 06:04.680 --> 06:05.720 Mac address. 06:05.730 --> 06:10.320 I don't think this is going to have any any effect. 06:10.330 --> 06:10.550 Yeah. 06:10.620 --> 06:12.540 Because the interface is shut down. 06:13.740 --> 06:14.080 Uh. 06:14.340 --> 06:15.180 Let's see. 06:16.920 --> 06:19.500 So, port security. 06:21.390 --> 06:24.630 And yeah, it's going to stay in that shut down state. 06:24.840 --> 06:34.290 Now, we could bump it along here by shutting it down administratively, shutting it down and then no 06:34.290 --> 06:34.830 shutting it. 06:35.770 --> 06:39.430 So that's going to bring the interface completely down. 06:39.550 --> 06:40.750 Bring it back up. 06:41.050 --> 06:44.020 The correct Mac address is now on the interface. 06:44.230 --> 06:46.900 So everything will start functioning again. 06:47.110 --> 06:51.100 I can do the same thing up here where I was experimenting with the feature. 06:51.370 --> 06:57.940 I can go in and say shut and no shut. 06:58.690 --> 07:04.810 And that should bring things back to life where we had another port security violation. 07:05.260 --> 07:09.310 So what an incredibly powerful feature. 07:09.550 --> 07:15.730 One that I want you practicing with and one that I want you, you know, fully understanding by locking 07:15.730 --> 07:21.970 down a switch port to the single Mac address that is legitimately supposed to be there. 07:22.150 --> 07:27.400 And maybe if that person has a voice over IP phone, you're going to go ahead and lock it down to those 07:27.400 --> 07:28.660 two MAC addresses. 07:28.900 --> 07:29.590 Oh, my gosh. 07:29.800 --> 07:36.760 That is going to foil such a huge number of attacks associated with MAC addresses and other levels. 07:36.940 --> 07:42.070 Like how about DHS CP based attacks that would also leverage Mac addressing. 07:42.220 --> 07:43.740 Those are all foiled as well.