AQ Learning Center

               Cisco Port Security Quick Configuration

Overview

Hello, boys and girls, let's start our discussion on Cisco port security feature. One of the key factor that we are not really worked on inside the network. Port security is the feature which secures your inside network so we should need to apply this feature at your layer 2 switches. In short, if your switch port is configured with port security then it will be considered as a secure port. Now lets quickly go into the configuration. This quick configuration article, if you want more detail on it, please visit the under mentioned link for reference.

https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst4500/12-2/25ew/configuration/guide/conf/port_sec.html

Note

• Port security only enable in access port, not in dynamic mode(By default port is dynamic as shown in Pic 01 as well)
  Means, first you need to put the port on switchport access mode then you can apply port security to the required port. It is recommended that apply port-security as per your requirements.
  
  
  
  
  
                                                (Pic-01)
  As per pic-01, when we go into the interface and try to enable port security by entering command "Switchport port-security". The command is rejected because the port is not in the access port.
  
  
  
  
  
  
  
  (Pic-02)                                         
  See in Pic-02, Now we have enter switchport mode access command which makes the interface in access mode, Then we have entered a port-security command to enable port security in the port. Now everything seems alright :)  
  
  
  
  
  
  
  
                                                   (Pic-03)
   See in Pic-03, Now we are applying port to learn only one mac address at a time, suppose we connect one laptop at the above port, Port lean one mac address then we connect another laptop to the same port. By doing this port will come up again because we have allowed one mac address at a time to the port. Note that by applying above command the mac address not sticky(We will discuss this in next pic-04). Many of us think by applying this command the only one mac address is allowed to the port which is wrong. One mac address at a time
  
  
  
  
  
                                                      (Pic-04)
   See in Pic-04, Now we have applied the sticky command to the port. By entering this command, now the mac address is sticky. Suppose we connect the laptop to the port, The port lean mac address XYZ. Now the port is sticky with XYZ mac address. then no other laptop will be able to connect with this port
  
                                                      (Pic-05)
   See in Pic-05, By entering this command, If any violation occurs as per above configuration then the ports automatically goes in shutdown mode. Assume the port is configured with sticky command with laptop-1, now we connect laptop-2 to the same port, then a violation occurs, the port will go in shutdown mode. If we check in show interface status command. The said port shows in error-disable mode. Under mentioned link is for understanding why port goes in error-disabled.
  
  
  https://aqlearningcenter.blogspot.com/2017/11/cisco-switch-ports-in-error-disable.html
  
  
  
  
  Now your port configuration is done now, Let me summarize the above commands in one go. 
  Note. guys, again I like to mention here, please configure your port security as per your need
  
  
  
  
  
  
  
                                                        (Pic-06)
  In Pic-06, Above is the basic recommended commands of port security

                        Configure Switch Passwords   

• Line Console

• Local user and specific passwords

Enable Password

• Tip

• If there is "no login" command in line mode then no authentication is going to meet and the connection will succeed without authentication which is not a good practice at all
• If there is login local command is present under line VTY then it is going to meet with aaa authentication. In our scenario, we consider login local command in AQ Learning switch. Now when we access this switch it will ask for the username and password then we will be able to access the switch.
• If the keyword Login exits and local is missing from line VTY then you must mention password underline VTY otherwise switch will not access through telnet/SSH

• Encrypted All Passwords

                    Configure VLAN On Cisco Switches

Tip:

• Assign Ports to VLANs

• Interface GigabitEthernet1/0/11

• switchport mode access

• Switchport access VLAN 101

• Spanning-tree portfast

• no shutdown

Virtual port channel step by step

Quick Introduction

Quick vPC Configurations steps

AQ Learning Center vPC Diagram

• Enable vPC Feature on Both Nexus

• Management VRF Context For Keepalive Update on Both Nexus

AQ-Learning-Center-Nexus-1

AQ-Learning-Center-Nexus-2

• Configure IP Route On Both Nexus

• Configure vPC Domain ID on Both Nexus (Same ID)

• Configure Role Priority on Both Nexus

AQ-Learning-Center-Nexus-1

AQ-Learning-Center-Nexus-2

• Configure IP of Source and Destination Keepalive

AQ-Learning-Center-Nexus-1

AQ-Learning-Center-Nexus-2

• Configure Port-Channel 2 on Nexus-1

• Configure Port-Channel 2 on Nexus-2

• Now Apply Port channel to Physical Ports on Nexus-1

• Now Apply Port channel to Physical Ports on Nexus 2