1 00:00:00,120 --> 00:00:00,990 In this lesson 2 00:00:00,990 --> 00:00:03,090 we're going to discuss port security. 3 00:00:03,090 --> 00:00:05,130 Port security is a common security feature 4 00:00:05,130 --> 00:00:06,420 found on network switches 5 00:00:06,420 --> 00:00:08,580 that allows administrators to restrict which devices 6 00:00:08,580 --> 00:00:10,590 can connect to a specific port based 7 00:00:10,590 --> 00:00:13,050 on their network interface card's MAC address. 8 00:00:13,050 --> 00:00:14,580 By enabling port security, 9 00:00:14,580 --> 00:00:17,460 your organization can prevent any unauthorized devices 10 00:00:17,460 --> 00:00:18,780 from accessing your network, 11 00:00:18,780 --> 00:00:20,520 which will help to increase the security 12 00:00:20,520 --> 00:00:22,080 of our given networks. 13 00:00:22,080 --> 00:00:24,270 Now, our network switches are networking devices 14 00:00:24,270 --> 00:00:27,360 that are going to operate at layer two of the OSI model. 15 00:00:27,360 --> 00:00:29,640 These devices make traffic switching decisions 16 00:00:29,640 --> 00:00:31,740 based upon the MAC address of the sending 17 00:00:31,740 --> 00:00:34,170 and receiving devices through a process called 18 00:00:34,170 --> 00:00:35,700 transparent bridging. 19 00:00:35,700 --> 00:00:37,590 Now, unlike hubs which are an older type 20 00:00:37,590 --> 00:00:38,700 of networking device, 21 00:00:38,700 --> 00:00:40,230 switches are going to use intelligence 22 00:00:40,230 --> 00:00:42,300 to prevent collisions on your network. 23 00:00:42,300 --> 00:00:44,310 Each port on a switch is going to be inside 24 00:00:44,310 --> 00:00:45,750 of its own collision domain, 25 00:00:45,750 --> 00:00:47,070 and this allows the switch ports 26 00:00:47,070 --> 00:00:49,110 to operate in full duplex mode. 27 00:00:49,110 --> 00:00:50,730 This means that a port can both send 28 00:00:50,730 --> 00:00:53,940 and receive data at the same time without a negative effect 29 00:00:53,940 --> 00:00:55,800 on the traffic being carried. 30 00:00:55,800 --> 00:00:57,330 This also increases the security 31 00:00:57,330 --> 00:00:58,590 of the traffic being carried 32 00:00:58,590 --> 00:01:01,140 because only the devices being addressed by the traffic 33 00:01:01,140 --> 00:01:03,660 are going to receive a copy of that data. 34 00:01:03,660 --> 00:01:05,519 A switch remembers which devices are connected 35 00:01:05,519 --> 00:01:08,070 to which switch port based on their MAC addresses, 36 00:01:08,070 --> 00:01:10,560 and this way they can forward traffic only to the ports 37 00:01:10,560 --> 00:01:13,440 that are involved inside of a particular conversation. 38 00:01:13,440 --> 00:01:16,200 In the past, our hubs would simply re-broadcast 39 00:01:16,200 --> 00:01:19,380 every piece of traffic out to every single switch port, 40 00:01:19,380 --> 00:01:21,180 but switches broadcast traffic 41 00:01:21,180 --> 00:01:22,890 to only the intended receiver, 42 00:01:22,890 --> 00:01:24,780 which makes switches much more efficient 43 00:01:24,780 --> 00:01:26,760 and more secure than a hub. 44 00:01:26,760 --> 00:01:27,900 All of these MAC addresses 45 00:01:27,900 --> 00:01:29,850 and the ports with which they're associated 46 00:01:29,850 --> 00:01:32,700 are going to be stored inside of our switches CAM table. 47 00:01:32,700 --> 00:01:35,400 Now the CAM table is spelled C-A-M, 48 00:01:35,400 --> 00:01:38,280 and this stands for the content addressable memory table, 49 00:01:38,280 --> 00:01:39,113 and it's going to be used 50 00:01:39,113 --> 00:01:41,100 to store information about the MAC addresses 51 00:01:41,100 --> 00:01:43,710 that are available on any given port of the switch. 52 00:01:43,710 --> 00:01:45,210 However, attackers have learned 53 00:01:45,210 --> 00:01:46,860 a technique called MAC flooding, 54 00:01:46,860 --> 00:01:49,110 which essentially causes a MAC address overflow 55 00:01:49,110 --> 00:01:51,420 to occur inside of that CAM table 56 00:01:51,420 --> 00:01:52,350 by flooding the switch 57 00:01:52,350 --> 00:01:54,960 with a bunch of randomized MAC addresses. 58 00:01:54,960 --> 00:01:57,840 When this happens, it can overfill the CAM table 59 00:01:57,840 --> 00:01:59,850 and the switch will simply fail open 60 00:01:59,850 --> 00:02:01,800 and simply begin to act like a hub. 61 00:02:01,800 --> 00:02:04,950 So your switch begins to rebroadcast all of its traffic 62 00:02:04,950 --> 00:02:06,960 out to every single port on the switch, 63 00:02:06,960 --> 00:02:10,350 and now that switch has lost its security advantage. 64 00:02:10,350 --> 00:02:11,910 To prevent this type of an attack, 65 00:02:11,910 --> 00:02:13,290 we should enable port security 66 00:02:13,290 --> 00:02:15,270 or MAC filtering on the switch ports, 67 00:02:15,270 --> 00:02:17,460 which are also known as interfaces. 68 00:02:17,460 --> 00:02:18,420 Now, by default, 69 00:02:18,420 --> 00:02:21,450 Cisco switches will have all their interfaces turned on, 70 00:02:21,450 --> 00:02:22,470 and this makes it easier 71 00:02:22,470 --> 00:02:25,290 and more convenient to add new switches into our network, 72 00:02:25,290 --> 00:02:28,680 but this practice is not considered to be very secure. 73 00:02:28,680 --> 00:02:30,540 For example, if we have a network jack 74 00:02:30,540 --> 00:02:33,120 that's sitting in a common room like our conference room 75 00:02:33,120 --> 00:02:34,890 or a lobby of our office building, 76 00:02:34,890 --> 00:02:36,750 how are we going to prevent unknown devices 77 00:02:36,750 --> 00:02:39,240 from plugging in a CAT 5E cable into it 78 00:02:39,240 --> 00:02:40,590 and gaining immediate access 79 00:02:40,590 --> 00:02:42,540 to everything inside of our network? 80 00:02:42,540 --> 00:02:44,340 Well, to help solve this problem, 81 00:02:44,340 --> 00:02:46,260 manufacturers provide a security feature 82 00:02:46,260 --> 00:02:48,060 known as port security. 83 00:02:48,060 --> 00:02:50,460 Now, port security allows a network administrator 84 00:02:50,460 --> 00:02:53,220 to associate a specific MAC address from a device 85 00:02:53,220 --> 00:02:54,930 to a specific interface. 86 00:02:54,930 --> 00:02:57,780 For example, we can restrict the network jack in the lobby 87 00:02:57,780 --> 00:02:59,280 to only accept MAC addresses 88 00:02:59,280 --> 00:03:00,930 from laptops that have been pre-approved 89 00:03:00,930 --> 00:03:03,720 by our network administrators for that use. 90 00:03:03,720 --> 00:03:06,120 Any other device that tries to plug into that switch port 91 00:03:06,120 --> 00:03:07,470 is going to be rejected 92 00:03:07,470 --> 00:03:10,290 and not given logical access to your network. 93 00:03:10,290 --> 00:03:13,560 Now, port security can be a very lengthy process to set up 94 00:03:13,560 --> 00:03:15,840 because we have to know each and every MAC address 95 00:03:15,840 --> 00:03:16,950 that we're going to want to connect 96 00:03:16,950 --> 00:03:18,930 to that individual switch port. 97 00:03:18,930 --> 00:03:20,520 To make this a little bit easier, 98 00:03:20,520 --> 00:03:22,470 most manufacturers allow us to set up 99 00:03:22,470 --> 00:03:24,300 what is known as a Sticky MAC. 100 00:03:24,300 --> 00:03:27,750 Now with Sticky MACs also called persistent MAC learning, 101 00:03:27,750 --> 00:03:28,980 we can enable an interface 102 00:03:28,980 --> 00:03:31,440 to dynamically associate the first MAC address 103 00:03:31,440 --> 00:03:33,030 that is connected to that switch port 104 00:03:33,030 --> 00:03:36,030 as an authorized MAC address in terms of port security, 105 00:03:36,030 --> 00:03:38,790 and this can then prevent access to any other MAC addresses 106 00:03:38,790 --> 00:03:40,890 that try to connect to that switch port. 107 00:03:40,890 --> 00:03:43,260 While these port security features are really good, 108 00:03:43,260 --> 00:03:46,230 they are not a silver bullet that will stop every attack. 109 00:03:46,230 --> 00:03:47,280 To overcome them, 110 00:03:47,280 --> 00:03:49,110 attackers have created lots of different ways 111 00:03:49,110 --> 00:03:51,690 to bypass this MAC filtering that's used inside 112 00:03:51,690 --> 00:03:53,880 of port security by resetting the MAC address 113 00:03:53,880 --> 00:03:55,590 of their own network interface cards 114 00:03:55,590 --> 00:03:58,650 to a known good Mac address on your pre-approved list. 115 00:03:58,650 --> 00:04:00,540 This type of MAC spoofing will allow them 116 00:04:00,540 --> 00:04:02,100 to easily connect to your network. 117 00:04:02,100 --> 00:04:03,570 And so for this reason, 118 00:04:03,570 --> 00:04:04,620 an organization needs 119 00:04:04,620 --> 00:04:07,140 to really use a more in-depth defensive plan, 120 00:04:07,140 --> 00:04:09,960 like one that includes 802.1x authentication, 121 00:04:09,960 --> 00:04:13,080 the use of the extensible authentication protocol or EAP 122 00:04:13,080 --> 00:04:14,850 and other kinds of security measures 123 00:04:14,850 --> 00:04:16,709 to provide additional layers of security 124 00:04:16,709 --> 00:04:17,880 to validate the devices 125 00:04:17,880 --> 00:04:20,399 as they're attempting to connect to a given network. 126 00:04:20,399 --> 00:04:23,430 Now, 802.1x authentication is going to rely 127 00:04:23,430 --> 00:04:25,770 on the 802.1x protocol. 128 00:04:25,770 --> 00:04:28,770 The 802.1x protocol is a standardized framework 129 00:04:28,770 --> 00:04:31,110 that's going to be used for port based authentication 130 00:04:31,110 --> 00:04:33,600 for both our wired and wireless networks. 131 00:04:33,600 --> 00:04:36,540 Because 802.1x is just the framework though, 132 00:04:36,540 --> 00:04:38,220 it's going to utilize other mechanisms 133 00:04:38,220 --> 00:04:40,560 to do the actual authentication process 134 00:04:40,560 --> 00:04:43,200 like using RADIUS or TACACS+. 135 00:04:43,200 --> 00:04:46,080 Now, for 802.1x authentication to work, 136 00:04:46,080 --> 00:04:48,690 it's going to require the use of three different roles, 137 00:04:48,690 --> 00:04:50,460 the supplicant, the authenticator, 138 00:04:50,460 --> 00:04:52,410 and the authentication service. 139 00:04:52,410 --> 00:04:54,510 The first of these is known as the supplicant, 140 00:04:54,510 --> 00:04:56,220 and this is the device or the user 141 00:04:56,220 --> 00:04:58,320 that's requesting access to your network. 142 00:04:58,320 --> 00:05:00,420 The second one we have is the authenticator, 143 00:05:00,420 --> 00:05:02,370 and this is the device through which the supplicant 144 00:05:02,370 --> 00:05:04,140 is attempting to access the network, 145 00:05:04,140 --> 00:05:05,310 such as a network switch, 146 00:05:05,310 --> 00:05:06,390 a wireless access point, 147 00:05:06,390 --> 00:05:08,460 or a VPN concentrator. 148 00:05:08,460 --> 00:05:11,010 The third one we have is an authentication server, 149 00:05:11,010 --> 00:05:12,690 which is going to be our centralized device 150 00:05:12,690 --> 00:05:14,250 that performs the authentication, 151 00:05:14,250 --> 00:05:16,440 and this is usually going to be configured as a RADIUS 152 00:05:16,440 --> 00:05:18,300 or TACACS+ server. 153 00:05:18,300 --> 00:05:20,970 Now, while RADIUS and TACACS+ can both perform the role 154 00:05:20,970 --> 00:05:22,110 of the authenticator, 155 00:05:22,110 --> 00:05:23,670 we have to determine which one of these 156 00:05:23,670 --> 00:05:26,490 is going to be best for our particular enterprise network. 157 00:05:26,490 --> 00:05:28,800 RADIUS is a cross-platform protocol, 158 00:05:28,800 --> 00:05:32,880 but TACACS+ is only used by Cisco proprietary devices. 159 00:05:32,880 --> 00:05:35,490 TACACS+ is going to be a little bit slower in operations 160 00:05:35,490 --> 00:05:38,340 because it relies on TCP for its transport protocol, 161 00:05:38,340 --> 00:05:40,380 but this does add additional security 162 00:05:40,380 --> 00:05:43,110 and independently conducts authentication authorization 163 00:05:43,110 --> 00:05:46,170 in the accounting process by using TACACS+. 164 00:05:46,170 --> 00:05:49,020 TACACS+ also supports all networking protocols, 165 00:05:49,020 --> 00:05:52,140 but RADIUS doesn't support the remote access protocol, 166 00:05:52,140 --> 00:05:53,430 NetBIOS Frame Protocol, 167 00:05:53,430 --> 00:05:56,490 or X.25 PAD connections. 168 00:05:56,490 --> 00:05:58,380 Overall, I find that TACACS+ 169 00:05:58,380 --> 00:06:00,270 is an excellent choice if we're only using 170 00:06:00,270 --> 00:06:02,820 Cisco devices across our entire network. 171 00:06:02,820 --> 00:06:04,320 Otherwise, I'll usually opt 172 00:06:04,320 --> 00:06:07,290 for using RADIUS in my 802.1x implementations 173 00:06:07,290 --> 00:06:09,330 when I have a mixed network infrastructure 174 00:06:09,330 --> 00:06:12,300 that contains Cisco and other networking devices. 175 00:06:12,300 --> 00:06:14,340 Now, when you're designing your security architecture 176 00:06:14,340 --> 00:06:15,570 for your enterprise network, 177 00:06:15,570 --> 00:06:17,880 you should definitely be using 802.1x 178 00:06:17,880 --> 00:06:19,530 as part of your defenses. 179 00:06:19,530 --> 00:06:22,170 Using 802.1x is one of the best protections 180 00:06:22,170 --> 00:06:23,940 that you can add to your internal network 181 00:06:23,940 --> 00:06:25,830 to prevent rogue devices from gaining access 182 00:06:25,830 --> 00:06:28,290 to our organization's devices and resources. 183 00:06:28,290 --> 00:06:30,570 Because it provides port based authentication, 184 00:06:30,570 --> 00:06:31,830 anything that connects to a switch 185 00:06:31,830 --> 00:06:33,300 or a wireless access point 186 00:06:33,300 --> 00:06:36,150 will be required to present itself for authentication using 187 00:06:36,150 --> 00:06:38,400 that 802.1x protocol prior 188 00:06:38,400 --> 00:06:40,680 to gaining access to the entire network. 189 00:06:40,680 --> 00:06:42,990 The 802.1x framework and protocol 190 00:06:42,990 --> 00:06:45,150 can also be used to encapsulate EAP 191 00:06:45,150 --> 00:06:48,150 or the extensible authentication protocol too. 192 00:06:48,150 --> 00:06:50,310 Now, the extensible authentication protocol, 193 00:06:50,310 --> 00:06:51,720 also known as EAP, 194 00:06:51,720 --> 00:06:54,000 is not a single protocol by itself, 195 00:06:54,000 --> 00:06:56,970 but instead, it is a framework in a series of protocols 196 00:06:56,970 --> 00:06:58,860 that allows for the numerous different ways 197 00:06:58,860 --> 00:07:00,600 for us to conduct authentication, 198 00:07:00,600 --> 00:07:02,880 including things like the use of simple passwords, 199 00:07:02,880 --> 00:07:04,140 the use of digital certificates, 200 00:07:04,140 --> 00:07:06,660 and the use of a public key infrastructure. 201 00:07:06,660 --> 00:07:08,790 There are lots of different variants of EAP, 202 00:07:08,790 --> 00:07:10,894 including EAP-MD5, 203 00:07:10,894 --> 00:07:12,515 EAP-TLS, 204 00:07:12,515 --> 00:07:14,211 EAP-TTLS, 205 00:07:14,211 --> 00:07:15,044 EAP-FAST, 206 00:07:15,896 --> 00:07:17,100 PEAP, 207 00:07:17,100 --> 00:07:18,870 and EAP-LEAP. 208 00:07:18,870 --> 00:07:21,390 Now let's take a look at these six variants of EAP 209 00:07:21,390 --> 00:07:23,250 to understand how they're different. 210 00:07:23,250 --> 00:07:25,350 First, we have EAP-MD5. 211 00:07:25,350 --> 00:07:28,800 Now, EAP-MD5 is a variant of EAP 212 00:07:28,800 --> 00:07:30,300 that utilizes simple passwords 213 00:07:30,300 --> 00:07:32,760 and the challenge handshake authentication process 214 00:07:32,760 --> 00:07:35,220 to provide remote access authentication. 215 00:07:35,220 --> 00:07:37,860 If you're using this method of EAP-MD5, 216 00:07:37,860 --> 00:07:38,700 you're going to have to ensure 217 00:07:38,700 --> 00:07:40,140 that you're using a long, strong, 218 00:07:40,140 --> 00:07:42,120 and complex password in order for you 219 00:07:42,120 --> 00:07:44,310 to maintain the security of your system. 220 00:07:44,310 --> 00:07:46,020 EAP-MD5 is considered 221 00:07:46,020 --> 00:07:48,090 to be a one-way authentication process, 222 00:07:48,090 --> 00:07:50,340 and it's not going to provide mutual authentication 223 00:07:50,340 --> 00:07:52,980 like some of the other versions of EAP will. 224 00:07:52,980 --> 00:07:55,080 Second, we have EAP-TLS. 225 00:07:55,080 --> 00:07:58,080 Now, EAP-TLS is a form of EAP 226 00:07:58,080 --> 00:07:59,760 that uses public key infrastructure 227 00:07:59,760 --> 00:08:01,830 with a digital certificate being installed 228 00:08:01,830 --> 00:08:03,510 on both your client and the server 229 00:08:03,510 --> 00:08:05,490 as a form of authentication. 230 00:08:05,490 --> 00:08:07,620 This makes it immune to password based attacks 231 00:08:07,620 --> 00:08:09,750 because neither side is going to use a password, 232 00:08:09,750 --> 00:08:11,970 and instead they're both using digital certificates 233 00:08:11,970 --> 00:08:13,590 to identify themselves. 234 00:08:13,590 --> 00:08:15,840 This is considered a form of mutual authentication 235 00:08:15,840 --> 00:08:17,670 because both devices, the client, 236 00:08:17,670 --> 00:08:19,830 and the server, each is going to go through 237 00:08:19,830 --> 00:08:21,120 and authenticate the other one 238 00:08:21,120 --> 00:08:23,160 as part of the connection process. 239 00:08:23,160 --> 00:08:26,700 The third one we have is known as EAP-TTLS. 240 00:08:26,700 --> 00:08:30,360 Now, EAP-TTLS is another variant of EAP, 241 00:08:30,360 --> 00:08:33,000 and this one requires a digital certificate on your server, 242 00:08:33,000 --> 00:08:34,679 but not on your client. 243 00:08:34,679 --> 00:08:36,690 Instead, the client is going to use a password 244 00:08:36,690 --> 00:08:38,730 for its part of the authentication process, 245 00:08:38,730 --> 00:08:40,140 which makes it a little bit more secure 246 00:08:40,140 --> 00:08:42,150 than the traditional EAP-MD5, 247 00:08:42,150 --> 00:08:44,460 which only uses passwords on both sides, 248 00:08:44,460 --> 00:08:47,910 but it is considered to be less secure than EAP-TLS 249 00:08:47,910 --> 00:08:50,190 because now we're only using one digital certificate 250 00:08:50,190 --> 00:08:51,540 and one password instead 251 00:08:51,540 --> 00:08:53,250 of using both digital certificates 252 00:08:53,250 --> 00:08:55,140 on the client and the server. 253 00:08:55,140 --> 00:08:57,480 Fourth, we have EAP-FAST. 254 00:08:57,480 --> 00:09:00,360 Now, EAP-FAST is another variant of EAP, 255 00:09:00,360 --> 00:09:01,230 and the FAST stands 256 00:09:01,230 --> 00:09:04,140 for the flexible authentication via secure tunneling, 257 00:09:04,140 --> 00:09:06,300 and this uses a protected access credential 258 00:09:06,300 --> 00:09:07,620 instead of a certificate 259 00:09:07,620 --> 00:09:10,860 to establish mutual authentication between two devices. 260 00:09:10,860 --> 00:09:13,980 Fifth, we have the EAP variant known as PEAP 261 00:09:13,980 --> 00:09:16,050 or the protected EAP. 262 00:09:16,050 --> 00:09:17,940 Now, the protected EAP variant, 263 00:09:17,940 --> 00:09:19,770 is going to support mutual authentication 264 00:09:19,770 --> 00:09:21,420 by using a server certificate 265 00:09:21,420 --> 00:09:23,760 and your Microsoft Active Directory database 266 00:09:23,760 --> 00:09:26,820 in order to authenticate a password from your given client. 267 00:09:26,820 --> 00:09:28,230 Sixth, we have LEAP. 268 00:09:28,230 --> 00:09:29,160 Now, up to this point, 269 00:09:29,160 --> 00:09:31,890 the other five versions of EAP are all considered 270 00:09:31,890 --> 00:09:34,200 to be cross platform, but with LEAP, 271 00:09:34,200 --> 00:09:36,150 we are talking about a proprietary protocol 272 00:09:36,150 --> 00:09:37,560 that was developed by Cisco, 273 00:09:37,560 --> 00:09:40,320 and this stands for the lightweight EAP. 274 00:09:40,320 --> 00:09:41,640 Now, because it's proprietary, 275 00:09:41,640 --> 00:09:44,070 it's only going to work on Cisco based devices. 276 00:09:44,070 --> 00:09:45,930 So unless you have all Cisco routers 277 00:09:45,930 --> 00:09:47,280 and switches in your network, 278 00:09:47,280 --> 00:09:48,113 you should really stick 279 00:09:48,113 --> 00:09:50,790 with one of the other types of EAP that we just discussed 280 00:09:50,790 --> 00:09:52,410 inside your network configuration, 281 00:09:52,410 --> 00:09:54,630 because it will work across all of your devices 282 00:09:54,630 --> 00:09:56,640 and not just Cisco devices. 283 00:09:56,640 --> 00:09:59,640 So remember, port security is a network switch feature 284 00:09:59,640 --> 00:10:01,440 that's going to restrict which devices can connect 285 00:10:01,440 --> 00:10:04,170 to specific ports based on their MAC addresses. 286 00:10:04,170 --> 00:10:08,190 802.1x is an IEEE standard for network access control 287 00:10:08,190 --> 00:10:09,540 that's going to authenticate devices 288 00:10:09,540 --> 00:10:10,890 based on their capabilities 289 00:10:10,890 --> 00:10:13,230 as primarily used at the data link layer, 290 00:10:13,230 --> 00:10:15,630 which is layer 2 of the OSI model. 291 00:10:15,630 --> 00:10:18,990 The extensible authentication protocol or EAP is considered 292 00:10:18,990 --> 00:10:21,090 to be a flexible authentication framework 293 00:10:21,090 --> 00:10:23,910 that's used in conjunction with 802.1x 294 00:10:23,910 --> 00:10:26,280 to support multiple authentication methods using 295 00:10:26,280 --> 00:10:27,955 either EAP-MD5, 296 00:10:27,955 --> 00:10:29,256 EAP-TLS, 297 00:10:29,256 --> 00:10:30,987 EAP-TTLS, 298 00:10:30,987 --> 00:10:32,070 EAP-FAST, 299 00:10:32,070 --> 00:10:33,120 PEAP, 300 00:10:33,120 --> 00:10:34,770 or EAP-LEAP. 301 00:10:34,770 --> 00:10:38,190 By integrating port security with 802.1x and EAP, 302 00:10:38,190 --> 00:10:40,020 our organizations can really increase 303 00:10:40,020 --> 00:10:42,690 their network security by ensuring that only authenticated 304 00:10:42,690 --> 00:10:44,760 and authorized devices can gain access 305 00:10:44,760 --> 00:10:47,163 to our most critical and sensitive resources.