1 1 00:00:00,230 --> 00:00:02,210 Port Security and VLANS. 2 2 00:00:02,210 --> 00:00:04,810 In this lesson, we're going to discuss the best practices 3 3 00:00:04,810 --> 00:00:07,070 of using Port Security, Private VLANS 4 4 00:00:07,070 --> 00:00:09,350 and how to securely configure your default VLANS 5 5 00:00:09,350 --> 00:00:10,560 on our networks. 6 6 00:00:10,560 --> 00:00:13,010 First, let's talk about Port Security. 7 7 00:00:13,010 --> 00:00:15,530 Now, Port Security is a dynamic feature that prevents 8 8 00:00:15,530 --> 00:00:18,010 unauthorized access to a switchport by restricting input 9 9 00:00:18,010 --> 00:00:20,780 to an interface by identifying and limiting 10 10 00:00:20,780 --> 00:00:22,240 the MAC addresses of the hosts 11 11 00:00:22,240 --> 00:00:23,800 that are allowed to connect to it. 12 12 00:00:23,800 --> 00:00:26,700 Basically Port Security refers to blocking unauthorized 13 13 00:00:26,700 --> 00:00:29,460 access to the physical switchport that's being used 14 14 00:00:29,460 --> 00:00:32,550 to allow the host to communicate on the Local Area Network. 15 15 00:00:32,550 --> 00:00:35,230 Now, Port Security also helps us mitigate MAC flooding 16 16 00:00:35,230 --> 00:00:37,830 by an attacker because only specific MAC addresses 17 17 00:00:37,830 --> 00:00:40,370 can communicate over a given switchport. 18 18 00:00:40,370 --> 00:00:42,440 Now, once you enable Port Security, 19 19 00:00:42,440 --> 00:00:44,140 this is going to make sure that only packets 20 20 00:00:44,140 --> 00:00:46,670 with a permitted source MAC address can send traffic 21 21 00:00:46,670 --> 00:00:48,060 through that switchport. 22 22 00:00:48,060 --> 00:00:51,530 This permitted MAC address is called a Secure MAC address. 23 23 00:00:51,530 --> 00:00:53,825 Now, Port Security can create a list of authorized 24 24 00:00:53,825 --> 00:00:56,600 MAC addresses by using their static configurations 25 25 00:00:56,600 --> 00:00:58,520 or through dynamic learning. 26 26 00:00:58,520 --> 00:01:01,150 Static Configurations allow you as an administrator 27 27 00:01:01,150 --> 00:01:03,160 to define the static MAC addresses to use 28 28 00:01:03,160 --> 00:01:04,670 on a given switchport. 29 29 00:01:04,670 --> 00:01:06,300 This works well for static environments, 30 30 00:01:06,300 --> 00:01:08,500 like a server firm, demilitarized zone, 31 31 00:01:08,500 --> 00:01:10,400 screen sub-net or data center. 32 32 00:01:10,400 --> 00:01:12,400 Now with dynamic learning of MAC addresses, 33 33 00:01:12,400 --> 00:01:14,350 we're going to use this when there's a maximum number 34 34 00:01:14,350 --> 00:01:17,360 of MAC addresses that are being defined for a given port. 35 35 00:01:17,360 --> 00:01:19,340 Then whenever that number is reached, 36 36 00:01:19,340 --> 00:01:21,970 the port will stop allowing new devices to connect to it 37 37 00:01:21,970 --> 00:01:24,820 and instead we'll block devices that it didn't already learn 38 38 00:01:24,820 --> 00:01:26,890 about and added to its learn list. 39 39 00:01:26,890 --> 00:01:29,040 Sometimes you'll hear this dynamic learning 40 40 00:01:29,040 --> 00:01:30,770 referred to as Sticky MAC. 41 41 00:01:30,770 --> 00:01:33,510 Basically, this is a great way to configure your switchports 42 42 00:01:33,510 --> 00:01:35,870 when you're going to be using them with end-user devices. 43 43 00:01:35,870 --> 00:01:37,620 You can set up all the switchports to allow 44 44 00:01:37,620 --> 00:01:40,200 only one MAC address to be learned per switchport, 45 45 00:01:40,200 --> 00:01:42,470 then whatever the first device is that connects 46 46 00:01:42,470 --> 00:01:43,972 that switch port it's going to be learned 47 47 00:01:43,972 --> 00:01:46,730 and all the others will be rejected by that switch, 48 48 00:01:46,730 --> 00:01:49,040 if they try to connect something to that switchport. 49 49 00:01:49,040 --> 00:01:51,240 Now, if you need to move that person to another office, 50 50 00:01:51,240 --> 00:01:53,190 for instance, you could go into the switch, 51 51 00:01:53,190 --> 00:01:55,240 clear the secure MAC for that switchport, 52 52 00:01:55,240 --> 00:01:57,640 and then the next device that connects would become 53 53 00:01:57,640 --> 00:01:59,900 the secure MAC for that switchport. 54 54 00:01:59,900 --> 00:02:02,340 Next, let's talk about Private VLANS. 55 55 00:02:02,340 --> 00:02:05,110 Private VLANS are also known as Port Isolation, 56 56 00:02:05,110 --> 00:02:07,630 and it's a technique where a VLAN contained switchports 57 57 00:02:07,630 --> 00:02:10,040 that are restricted to using a single uplink. 58 58 00:02:10,040 --> 00:02:12,900 Now, the purpose of a Private VLAN or Port Isolation 59 59 00:02:12,900 --> 00:02:15,178 is to divide a primary VLAN into secondary 60 60 00:02:15,178 --> 00:02:19,230 or sub VLANS while still using the existing sub-net. 61 61 00:02:19,230 --> 00:02:22,000 While a normal VLAN has a single broadcast domain, 62 62 00:02:22,000 --> 00:02:24,670 a Private VLAN can break up that broadcast domain 63 63 00:02:24,670 --> 00:02:27,350 into multiple smaller broadcast sub domains. 64 64 00:02:27,350 --> 00:02:29,460 There are three different types of VLANS. 65 65 00:02:29,460 --> 00:02:32,490 We have Primary VLANS, Secondary isolated VLANS 66 66 00:02:32,490 --> 00:02:34,540 and Secondary community VLANS. 67 67 00:02:34,540 --> 00:02:37,200 A Primary VLANS is simply the original VLAN 68 68 00:02:37,200 --> 00:02:39,190 and it isn't used with private VLANS. 69 69 00:02:39,190 --> 00:02:41,880 Primary VLANS are used to forward frames downstream 70 70 00:02:41,880 --> 00:02:43,469 to all secondary VLANS. 71 71 00:02:43,469 --> 00:02:46,900 The secondary VLANS are broken down into two types, 72 72 00:02:46,900 --> 00:02:49,350 isolated VLANS and community VLANS. 73 73 00:02:49,350 --> 00:02:52,150 Now an isolated VLAN is a type of secondary VLAN 74 74 00:02:52,150 --> 00:02:54,240 that's going to include any switchports that can reach 75 75 00:02:54,240 --> 00:02:57,225 the primary VLAN but not other secondary VLANS. 76 76 00:02:57,225 --> 00:02:59,850 An isolated VLAN will also prevent each host 77 77 00:02:59,850 --> 00:03:01,210 from communicating with each other. 78 78 00:03:01,210 --> 00:03:03,560 So this gives you true port isolation 79 79 00:03:03,560 --> 00:03:05,640 and adds the security of your network. 80 80 00:03:05,640 --> 00:03:08,420 Now, a community VLAN is the second type of VLAN 81 81 00:03:08,420 --> 00:03:10,620 that includes any switchports that can communicate 82 82 00:03:10,620 --> 00:03:12,580 with each other and the primary VLAN 83 83 00:03:12,580 --> 00:03:15,180 but not with other secondary VLANs. 84 84 00:03:15,180 --> 00:03:17,210 In this case, we don't see port isolation 85 85 00:03:17,210 --> 00:03:19,530 between hosts in a given secondary VLAN 86 86 00:03:19,530 --> 00:03:22,690 but instead we only receive isolation between various groups 87 87 00:03:22,690 --> 00:03:25,180 of hosts in other secondary VLANs. 88 88 00:03:25,180 --> 00:03:26,730 When you're working with private VLANS 89 89 00:03:26,730 --> 00:03:27,763 there are a few different types of ports 90 90 00:03:27,763 --> 00:03:29,380 that are going to come across. 91 91 00:03:29,380 --> 00:03:32,550 First, we have Promiscuous Ports or P-Ports. 92 92 00:03:32,550 --> 00:03:34,520 These are switchports that connect to the router, 93 93 00:03:34,520 --> 00:03:37,140 the firewall, or other common gateway devices. 94 94 00:03:37,140 --> 00:03:39,420 These ports can communicate with anything that's connected 95 95 00:03:39,420 --> 00:03:41,920 to either the primary or secondary VLANs. 96 96 00:03:41,920 --> 00:03:44,480 Basically this type of port is not isolated, 97 97 00:03:44,480 --> 00:03:47,050 and instead it can send and receive frames to and from 98 98 00:03:47,050 --> 00:03:49,560 any other port inside of the VLAN. 99 99 00:03:49,560 --> 00:03:51,440 Second, we have Host Ports. 100 100 00:03:51,440 --> 00:03:53,600 These are going to be broken down into isolated ports 101 101 00:03:53,600 --> 00:03:56,780 or I-Ports and community ports, or C-Ports. 102 102 00:03:56,780 --> 00:03:59,050 Isolated ports or I-Ports are going to be used 103 103 00:03:59,050 --> 00:04:00,330 to connect a regular host 104 104 00:04:00,330 --> 00:04:02,710 that's going to reside on an isolated VLAN. 105 105 00:04:02,710 --> 00:04:05,840 These I-Ports can only communicate upwards to a P-Port 106 106 00:04:05,840 --> 00:04:08,270 and they can not talk to other I-Ports. 107 107 00:04:08,270 --> 00:04:10,750 Community ports or C-Ports are going to be used 108 108 00:04:10,750 --> 00:04:13,960 to connect a regular host that resides on a community VLAN. 109 109 00:04:13,960 --> 00:04:16,610 The C-Ports can communicate upwards to P-Ports 110 110 00:04:16,610 --> 00:04:20,780 and across the other C-Ports within the same community VLAN. 111 111 00:04:20,780 --> 00:04:23,230 Next, let's talk about default VLANs. 112 112 00:04:23,230 --> 00:04:25,520 By default, you want to ensure all your switchports 113 113 00:04:25,520 --> 00:04:27,030 are assigned to a VLAN. 114 114 00:04:27,030 --> 00:04:29,530 If you don't have them assigned to a particular user VLAN 115 115 00:04:29,530 --> 00:04:32,070 something like sales or marketing or human resources, 116 116 00:04:32,070 --> 00:04:34,970 then they're all going to get assigned to the default VLAN 117 117 00:04:34,970 --> 00:04:37,040 as part of the unassigned switchports. 118 118 00:04:37,040 --> 00:04:38,500 Now, if you're using a Cisco device, 119 119 00:04:38,500 --> 00:04:40,390 they're going to do this for you automatically. 120 120 00:04:40,390 --> 00:04:42,810 If you're not, you may have to manually do it. 121 121 00:04:42,810 --> 00:04:45,710 Now, the default VLAN is known as VLAN 1. 122 122 00:04:45,710 --> 00:04:47,830 Personally, I don't like assigning all my unused 123 123 00:04:47,830 --> 00:04:50,950 switchports to the default VLAN because malicious attackers 124 124 00:04:50,950 --> 00:04:53,760 know that many businesses use VLAN 1 by default, 125 125 00:04:53,760 --> 00:04:56,360 and then attempt to use it to conduct VLN hopping. 126 126 00:04:56,360 --> 00:04:59,806 Instead, I prefer to create a separate VLAN called unused, 127 127 00:04:59,806 --> 00:05:03,290 and I put all my unused switchports and assign them there. 128 128 00:05:03,290 --> 00:05:05,260 This way, if an attacker connects to one of those 129 129 00:05:05,260 --> 00:05:07,790 unused ports and they bypass my port security 130 130 00:05:07,790 --> 00:05:09,310 and they enable the port somehow, 131 131 00:05:09,310 --> 00:05:11,380 they're still going to be isolated and not communicating 132 132 00:05:11,380 --> 00:05:13,550 with any of my other clients or servers. 133 133 00:05:13,550 --> 00:05:16,380 So, what makes this default VLAN that we're talking 134 134 00:05:16,380 --> 00:05:17,860 about so special? 135 135 00:05:17,860 --> 00:05:20,440 Well, if a client is sending data to the network 136 136 00:05:20,440 --> 00:05:22,768 and it doesn't contain a VLAN tag then it considers 137 137 00:05:22,768 --> 00:05:26,160 that traffic destined for the default VLAN. 138 138 00:05:26,160 --> 00:05:28,590 So if you don't have VLANs configuring your network, 139 139 00:05:28,590 --> 00:05:30,160 all your traffic is going to use 140 140 00:05:30,160 --> 00:05:32,420 the default VLAN, VLAN 1. 141 141 00:05:32,420 --> 00:05:35,010 By default, your default VLAN is also the same 142 142 00:05:35,010 --> 00:05:36,500 as your Native VLAN. 143 143 00:05:36,500 --> 00:05:38,820 These terms are often used interchangeably. 144 144 00:05:38,820 --> 00:05:41,420 The Native VLAN is revealing where untagged traffic is 145 145 00:05:41,420 --> 00:05:44,250 going to go whenever it's received on a trunk port. 146 146 00:05:44,250 --> 00:05:46,600 This allows our switches and other layer two devices 147 147 00:05:46,600 --> 00:05:48,631 to support legacy devices or devices that don't 148 148 00:05:48,631 --> 00:05:50,420 use tagging on their traffic, 149 149 00:05:50,420 --> 00:05:53,530 and still get that traffic to this Native VLAN. 150 150 00:05:53,530 --> 00:05:55,530 Now, this is really useful when you connect things like 151 151 00:05:55,530 --> 00:05:57,910 wireless access points and network attached devices 152 152 00:05:57,910 --> 00:05:58,743 to your network. 153 153 00:05:58,743 --> 00:06:00,220 And so it's important for you to understand 154 154 00:06:00,220 --> 00:06:03,690 that the default VLAN is VLAN 1 and the Native VLAN 155 155 00:06:03,690 --> 00:06:05,043 is also the default VLAN.