-: Port Security and VLANS. 2 2
In this lesson, we're going to discuss the best practices 3 3
of using Port Security, Private VLANS 4 4
and how to securely configure your default VLANS 5 5
on our networks. 6 6
First, let's talk about Port Security. 7 7
Now, Port Security is a dynamic feature that prevents 8 8
unauthorized access to a switchport by restricting input 9 9
to an interface by identifying and limiting 10 10
the MAC addresses of the hosts 11 11
that are allowed to connect to it. 12 12
Basically Port Security refers to blocking unauthorized 13 13
access to the physical switchport that's being used 14 14
to allow the host to communicate on the Local Area Network. 15 15
Now, Port Security also helps us mitigate MAC flooding 16 16
by an attacker because only specific MAC addresses 17 17
can communicate over a given switchport. 18 18
Now, once you enable Port Security, 19 19
this is going to make sure that only packets 20 20
with a permitted source MAC address can send traffic 21 21
through that switchport. 22 22
This permitted MAC address is called a Secure MAC address. 23 23
Now, Port Security can create a list of authorized 24 24
MAC addresses by using their static configurations 25 25
or through dynamic learning. 26 26
Static Configurations allow you as an administrator 27 27
to define the static MAC addresses to use 28 28
on a given switchport. 29 29
This works well for static environments, 30 30
like a server firm, demilitarized zone, 31 31
screen sub-net or data center. 32 32
Now with dynamic learning of MAC addresses, 33 33
we're going to use this when there's a maximum number 34 34
of MAC addresses that are being defined for a given port. 35 35
Then whenever that number is reached, 36 36
the port will stop allowing new devices to connect to it 37 37
and instead we'll block devices that it didn't already learn 38 38
about and added to its learn list. 39 39
Sometimes you'll hear this dynamic learning 40 40
referred to as Sticky MAC. 41 41
Basically, this is a great way to configure your switchports 42 42
when you're going to be using them with end-user devices. 43 43
You can set up all the switchports to allow 44 44
only one MAC address to be learned per switchport, 45 45
then whatever the first device is that connects 46 46
that switch port it's going to be learned 47 47
and all the others will be rejected by that switch, 48 48
if they try to connect something to that switchport. 49 49
Now, if you need to move that person to another office, 50 50
for instance, you could go into the switch, 51 51
clear the secure MAC for that switchport, 52 52
and then the next device that connects would become 53 53
the secure MAC for that switchport. 54 54
Next, let's talk about Private VLANS. 55 55
Private VLANS are also known as Port Isolation, 56 56
and it's a technique where a VLAN contained switchports 57 57
that are restricted to using a single uplink. 58 58
Now, the purpose of a Private VLAN or Port Isolation 59 59
is to divide a primary VLAN into secondary 60 60
or sub VLANS while still using the existing sub-net. 61 61
While a normal VLAN has a single broadcast domain, 62 62
a Private VLAN can break up that broadcast domain 63 63
into multiple smaller broadcast sub domains. 64 64
There are three different types of VLANS. 65 65
We have Primary VLANS, Secondary isolated VLANS 66 66
and Secondary community VLANS. 67 67
A Primary VLANS is simply the original VLAN 68 68
and it isn't used with private VLANS. 69 69
Primary VLANS are used to forward frames downstream 70 70
to all secondary VLANS. 71 71
The secondary VLANS are broken down into two types, 72 72
isolated VLANS and community VLANS. 73 73
Now an isolated VLAN is a type of secondary VLAN 74 74
that's going to include any switchports that can reach 75 75
the primary VLAN but not other secondary VLANS. 76 76
An isolated VLAN will also prevent each host 77 77
from communicating with each other. 78 78
So this gives you true port isolation 79 79
and adds the security of your network. 80 80
Now, a community VLAN is the second type of VLAN 81 81
that includes any switchports that can communicate 82 82
with each other and the primary VLAN 83 83
but not with other secondary VLANs. 84 84
In this case, we don't see port isolation 85 85
between hosts in a given secondary VLAN 86 86
but instead we only receive isolation between various groups 87 87
of hosts in other secondary VLANs. 88 88
When you're working with private VLANS 89 89
there are a few different types of ports 90 90
that are going to come across. 91 91
First, we have Promiscuous Ports or P-Ports. 92 92
These are switchports that connect to the router, 93 93
the firewall, or other common gateway devices. 94 94
These ports can communicate with anything that's connected 95 95
to either the primary or secondary VLANs. 96 96
Basically this type of port is not isolated, 97 97
and instead it can send and receive frames to and from 98 98
any other port inside of the VLAN. 99 99
Second, we have Host Ports. 100 100
These are going to be broken down into isolated ports 101 101
or I-Ports and community ports, or C-Ports. 102 102
Isolated ports or I-Ports are going to be used 103 103
to connect a regular host 104 104
that's going to reside on an isolated VLAN. 105 105
These I-Ports can only communicate upwards to a P-Port 106 106
and they can not talk to other I-Ports. 107 107
Community ports or C-Ports are going to be used 108 108
to connect a regular host that resides on a community VLAN. 109 109
The C-Ports can communicate upwards to P-Ports 110 110
and across the other C-Ports within the same community VLAN. 111 111
Next, let's talk about default VLANs. 112 112
By default, you want to ensure all your switchports 113 113
are assigned to a VLAN. 114 114
If you don't have them assigned to a particular user VLAN 115 115
something like sales or marketing or human resources, 116 116
then they're all going to get assigned to the default VLAN 117 117
as part of the unassigned switchports. 118 118
Now, if you're using a Cisco device, 119 119
they're going to do this for you automatically. 120 120
If you're not, you may have to manually do it. 121 121
Now, the default VLAN is known as VLAN 1. 122 122
Personally, I don't like assigning all my unused 123 123
switchports to the default VLAN because malicious attackers 124 124
know that many businesses use VLAN 1 by default, 125 125
and then attempt to use it to conduct VLN hopping. 126 126
Instead, I prefer to create a separate VLAN called unused, 127 127
and I put all my unused switchports and assign them there. 128 128
This way, if an attacker connects to one of those 129 129
unused ports and they bypass my port security 130 130
and they enable the port somehow, 131 131
they're still going to be isolated and not communicating 132 132
with any of my other clients or servers. 133 133
So, what makes this default VLAN that we're talking 134 134
about so special? 135 135
Well, if a client is sending data to the network 136 136
and it doesn't contain a VLAN tag then it considers 137 137
that traffic destined for the default VLAN. 138 138
So if you don't have VLANs configuring your network, 139 139
all your traffic is going to use 140 140
the default VLAN, VLAN 1. 141 141
By default, your default VLAN is also the same 142 142
as your Native VLAN. 143 143
These terms are often used interchangeably. 144 144
The Native VLAN is revealing where untagged traffic is 145 145
going to go whenever it's received on a trunk port. 146 146
This allows our switches and other layer two devices 147 147
to support legacy devices or devices that don't 148 148
use tagging on their traffic, 149 149
and still get that traffic to this Native VLAN. 150 150
Now, this is really useful when you connect things like 151 151
wireless access points and network attached devices 152 152
to your network. 153 153
And so it's important for you to understand 154 154
that the default VLAN is VLAN 1 and the Native VLAN 155 155
is also the default VLAN.