Switch port security

Cisco switches come with some undesirable defaults:

• The ports are open (whereas router interfaces are shut by default), so use shutdown command on unused ports
• They are actively attempting to trunk, so use the switchport mode access command so it cannot trunk
• All ports are in VLAN 1, so place the port into an unused dummy VLAN

To lock down a particular port for a particular MAC address:

cont f
int fast 0/1
switchport mode access
switchport port-security mac-address aa-aa-aa-aa-aa-aa
switchport port-security mac-address sticky (the first MAC address connected will be used)
switchport port-security violation ?

shutdown, which is the default, will shut the port down, logs the action taken and interface status will be "err-disabled" - this must be manually reopened.

restrict will drop the frames, logs the message indicating an issue, but does not shutdown the port.

protect simply drops the violating frames.

show port-security int fast 0/1 command shows you all the info.

Forward it; Flood it; Filter it

A cisco switch will do one of three things to an incoming frame (remember, a switch is a layer 2 device -> Data link layer -> Frames):

• Forward it
• Flood it
• Filter it

The decision is based on the MAC address table. The MAC address table is created based on the INCOMING address in the frame. If the incoming frame source MAC address isn't listed in the table, the switch will add it to it's table with the Vlan, the type and the port it's connected to, i.e. 

• Forwarding happens when the switch has an entry for the destination MAC address in it's MAC address table and forwards the frame out a single port. 

• Flooding happens when the switch doesn't have an entry for the destination MAC address in the MAC address table. The frame gets sent out every port on the switch except for the one it came in on.

• Filtering happens when the switch has an entry for both the source and destination MAC address AND the MAC table indicates that both addresses are found to be on the same port.

If a host gets disconnected from one port and connected to another, the switch will notice that the incoming frame source MAC address is now on a different port and updates it's MAC address table accordingly.

Once the switch decides to either forward or flood, it also must figure out which processing method to use:

• Store-and-forward
• Cut-through
• Fragment-free

With the store-and-forward method, the switch stores the entire frame on the switch. After checking the FCS (frame check sequence) for corruption, it continues forwarding on the frame. I.e. more error detection.

With cut-through it will forward on the frame without reading the FCS even before all the frame has been received. This means it's faster, but with less error detection.

With fragment-free, the switch only checks the first 64 bytes for corruption as it assumes that if there is going to be any corruption, it'll happen in the first 64 bytes. This is considered to be the middle ground between the two above.

Switching basics!

The third video is quite an interesting one, however, it does take a little while to get into the more "interesting" stuff. Again, it's mostly all theory and starts off listing the layer 1 devices and the first layer 2 device, a bridge:

• A repeater simply amplifies the transmission
• A hub is basically a repeater with multiple ports
• A bridge connects two hubs together

Anything connected to a hub is considered to be in the same collision and broadcast domain. They also depend on CSMA/CD.

A bridge separates two hubs. This splits the collision domain into two, however, there is still only one broadcast domain.

Anything connected to a switch is considered to be in it's own collision domain but they will all be in the same broadcast domain (assuming all in the same VLAN).

Creating VLANs create new broadcast domains as traffic from one VLAN cannot reach another VLAN without the intervention of a layer 3 device, most likely a router.

Cisco switches use STP (spanning tree protocol) to prevent switching loops and is enabled by default. STP determines a loop-free path for frames and ports that are not on that path will be placed into blocking mode.