In this lesson
we're going to discuss port security.
Port security is a common security feature
found on network switches
that allows administrators to restrict which devices
can connect to a specific port based
on their network interface card's MAC address.
By enabling port security,
your organization can prevent any unauthorized devices
from accessing your network,
which will help to increase the security
of our given networks.
Now, our network switches are networking devices
that are going to operate at layer two of the OSI model.
These devices make traffic switching decisions
based upon the MAC address of the sending
and receiving devices through a process called
transparent bridging.
Now, unlike hubs which are an older type
of networking device,
switches are going to use intelligence
to prevent collisions on your network.
Each port on a switch is going to be inside
of its own collision domain,
and this allows the switch ports
to operate in full duplex mode.
This means that a port can both send
and receive data at the same time without a negative effect
on the traffic being carried.
This also increases the security
of the traffic being carried
because only the devices being addressed by the traffic
are going to receive a copy of that data.
A switch remembers which devices are connected
to which switch port based on their MAC addresses,
and this way they can forward traffic only to the ports
that are involved inside of a particular conversation.
In the past, our hubs would simply re-broadcast
every piece of traffic out to every single switch port,
but switches broadcast traffic
to only the intended receiver,
which makes switches much more efficient
and more secure than a hub.
All of these MAC addresses
and the ports with which they're associated
are going to be stored inside of our switches CAM table.
Now the CAM table is spelled C-A-M,
and this stands for the content addressable memory table,
and it's going to be used
to store information about the MAC addresses
that are available on any given port of the switch.
However, attackers have learned
a technique called MAC flooding,
which essentially causes a MAC address overflow
to occur inside of that CAM table
by flooding the switch
with a bunch of randomized MAC addresses.
When this happens, it can overfill the CAM table
and the switch will simply fail open
and simply begin to act like a hub.
So your switch begins to rebroadcast all of its traffic
out to every single port on the switch,
and now that switch has lost its security advantage.
To prevent this type of an attack,
we should enable port security
or MAC filtering on the switch ports,
which are also known as interfaces.
Now, by default,
Cisco switches will have all their interfaces turned on,
and this makes it easier
and more convenient to add new switches into our network,
but this practice is not considered to be very secure.
For example, if we have a network jack
that's sitting in a common room like our conference room
or a lobby of our office building,
how are we going to prevent unknown devices
from plugging in a CAT 5E cable into it
and gaining immediate access
to everything inside of our network?
Well, to help solve this problem,
manufacturers provide a security feature
known as port security.
Now, port security allows a network administrator
to associate a specific MAC address from a device
to a specific interface.
For example, we can restrict the network jack in the lobby
to only accept MAC addresses
from laptops that have been pre-approved
by our network administrators for that use.
Any other device that tries to plug into that switch port
is going to be rejected
and not given logical access to your network.
Now, port security can be a very lengthy process to set up
because we have to know each and every MAC address
that we're going to want to connect
to that individual switch port.
To make this a little bit easier,
most manufacturers allow us to set up
what is known as a Sticky MAC.
Now with Sticky MACs also called persistent MAC learning,
we can enable an interface
to dynamically associate the first MAC address
that is connected to that switch port
as an authorized MAC address in terms of port security,
and this can then prevent access to any other MAC addresses
that try to connect to that switch port.
While these port security features are really good,
they are not a silver bullet that will stop every attack.
To overcome them,
attackers have created lots of different ways
to bypass this MAC filtering that's used inside
of port security by resetting the MAC address
of their own network interface cards
to a known good Mac address on your pre-approved list.
This type of MAC spoofing will allow them
to easily connect to your network.
And so for this reason,
an organization needs
to really use a more in-depth defensive plan,
like one that includes 802.1x authentication,
the use of the extensible authentication protocol or EAP
and other kinds of security measures
to provide additional layers of security
to validate the devices
as they're attempting to connect to a given network.
Now, 802.1x authentication is going to rely
on the 802.1x protocol.
The 802.1x protocol is a standardized framework
that's going to be used for port based authentication
for both our wired and wireless networks.
Because 802.1x is just the framework though,
it's going to utilize other mechanisms
to do the actual authentication process
like using RADIUS or TACACS+.
Now, for 802.1x authentication to work,
it's going to require the use of three different roles,
the supplicant, the authenticator,
and the authentication service.
The first of these is known as the supplicant,
and this is the device or the user
that's requesting access to your network.
The second one we have is the authenticator,
and this is the device through which the supplicant
is attempting to access the network,
such as a network switch,
a wireless access point,
or a VPN concentrator.
The third one we have is an authentication server,
which is going to be our centralized device
that performs the authentication,
and this is usually going to be configured as a RADIUS
or TACACS+ server.
Now, while RADIUS and TACACS+ can both perform the role
of the authenticator,
we have to determine which one of these
is going to be best for our particular enterprise network.
RADIUS is a cross-platform protocol,
but TACACS+ is only used by Cisco proprietary devices.
TACACS+ is going to be a little bit slower in operations
because it relies on TCP for its transport protocol,
but this does add additional security
and independently conducts authentication authorization
in the accounting process by using TACACS+.
TACACS+ also supports all networking protocols,
but RADIUS doesn't support the remote access protocol,
NetBIOS Frame Protocol,
or X.25 PAD connections.
Overall, I find that TACACS+
is an excellent choice if we're only using
Cisco devices across our entire network.
Otherwise, I'll usually opt
for using RADIUS in my 802.1x implementations
when I have a mixed network infrastructure
that contains Cisco and other networking devices.
Now, when you're designing your security architecture
for your enterprise network,
you should definitely be using 802.1x
as part of your defenses.
Using 802.1x is one of the best protections
that you can add to your internal network
to prevent rogue devices from gaining access
to our organization's devices and resources.
Because it provides port based authentication,
anything that connects to a switch
or a wireless access point
will be required to present itself for authentication using
that 802.1x protocol prior
to gaining access to the entire network.
The 802.1x framework and protocol
can also be used to encapsulate EAP
or the extensible authentication protocol too.
Now, the extensible authentication protocol,
also known as EAP,
is not a single protocol by itself,
but instead, it is a framework in a series of protocols
that allows for the numerous different ways
for us to conduct authentication,
including things like the use of simple passwords,
the use of digital certificates,
and the use of a public key infrastructure.
There are lots of different variants of EAP,
including EAP-MD5,
EAP-TLS,
EAP-TTLS,
EAP-FAST,
PEAP,
and EAP-LEAP.
Now let's take a look at these six variants of EAP
to understand how they're different.
First, we have EAP-MD5.
Now, EAP-MD5 is a variant of EAP
that utilizes simple passwords
and the challenge handshake authentication process
to provide remote access authentication.
If you're using this method of EAP-MD5,
you're going to have to ensure
that you're using a long, strong,
and complex password in order for you
to maintain the security of your system.
EAP-MD5 is considered
to be a one-way authentication process,
and it's not going to provide mutual authentication
like some of the other versions of EAP will.
Second, we have EAP-TLS.
Now, EAP-TLS is a form of EAP
that uses public key infrastructure
with a digital certificate being installed
on both your client and the server
as a form of authentication.
This makes it immune to password based attacks
because neither side is going to use a password,
and instead they're both using digital certificates
to identify themselves.
This is considered a form of mutual authentication
because both devices, the client,
and the server, each is going to go through
and authenticate the other one
as part of the connection process.
The third one we have is known as EAP-TTLS.
Now, EAP-TTLS is another variant of EAP,
and this one requires a digital certificate on your server,
but not on your client.
Instead, the client is going to use a password
for its part of the authentication process,
which makes it a little bit more secure
than the traditional EAP-MD5,
which only uses passwords on both sides,
but it is considered to be less secure than EAP-TLS
because now we're only using one digital certificate
and one password instead
of using both digital certificates
on the client and the server.
Fourth, we have EAP-FAST.
Now, EAP-FAST is another variant of EAP,
and the FAST stands
for the flexible authentication via secure tunneling,
and this uses a protected access credential
instead of a certificate
to establish mutual authentication between two devices.
Fifth, we have the EAP variant known as PEAP
or the protected EAP.
Now, the protected EAP variant,
is going to support mutual authentication
by using a server certificate
and your Microsoft Active Directory database
in order to authenticate a password from your given client.
Sixth, we have LEAP.
Now, up to this point,
the other five versions of EAP are all considered
to be cross platform, but with LEAP,
we are talking about a proprietary protocol
that was developed by Cisco,
and this stands for the lightweight EAP.
Now, because it's proprietary,
it's only going to work on Cisco based devices.
So unless you have all Cisco routers
and switches in your network,
you should really stick
with one of the other types of EAP that we just discussed
inside your network configuration,
because it will work across all of your devices
and not just Cisco devices.
So remember, port security is a network switch feature
that's going to restrict which devices can connect
to specific ports based on their MAC addresses.
802.1x is an IEEE standard for network access control
that's going to authenticate devices
based on their capabilities
as primarily used at the data link layer,
which is layer 2 of the OSI model.
The extensible authentication protocol or EAP is considered
to be a flexible authentication framework
that's used in conjunction with 802.1x
to support multiple authentication methods using
either EAP-MD5,
EAP-TLS,
EAP-TTLS,
EAP-FAST,
PEAP,
or EAP-LEAP.
By integrating port security with 802.1x and EAP,
our organizations can really increase
their network security by ensuring that only authenticated
and authorized devices can gain access
to our most critical and sensitive resources.