Switch Port Security
I recently had to protect the switch ports on a Cisco switch. This is a good idea for all businesses, particularly if the switches are not physically secured (in a comms room) or the switch ports are patched through to outlets in offices.
As far as I can see there are four methods for securing the ports on a Cisco switch:
Shut down the ports that aren't in use.
Use the Cisco proprietary method.
Use 802.1x to secure the ports.
A combination of 2 and 3!
802.1x Port Security
Number 1 is fairly simple and good practice if you aren't using 802.1x. 802.1x allows you to configure the switch ports so that when a device is connected it is authenticated against a AAA server (i.e. RADIUS) which in turn will send back an ACCESS-ACCEPT or ACCESS-REJECT packet based upon a number of attribute in the ACCESS-REQUEST packet (i.e. MAC Address or username and password).
Unfortunately this option wasn't open to me as the RADIUS server deployed on the site is only compliant with the original RADIUS RFC. The original RFC states that the authentication methods PAP and CHAP must be supported. For 802.1x security the RADIUS server must support EAP. So this was out of the question.
Cisco Method
This left me with using a combination of number 1 and number 2. The network I configure has a combination of switch ports with either 1 device (printer/server/access-point etc.), 2 devices (PC and IP phone) or no devices.
On the ports where I had no devices I simply issued the shutdown command on the interface:
switch(config-if)#shutdown
For ports where there was one device I configured port security with stick MAC addresses with shutdown on violation. This means that the switch learns which devices are connected to the switch port, learns the addresses and then shuts down the port if a rogue device is detected on the port:
switch(config-if)#shutdown
switch(config-if)#switchport port-security
switch(config-if)#switchport port-security mac-address sticky
switch(config-if)#switchport port-security violation shutdown
switch(config-if)#switchport port-security maximum 1
switch(config-if)#no shutdown
It is also a good idea to configure your switch to send log alerts to an SNMP server or a Syslog server so you know when there has been a violation on a switch port.
One thing I realised after configuring a switch port is that sometimes an IP phone was unable to connect. I read the Cisco documentation and they recommend using the following command when the switch port is in trunk mode:
switch(config-if)#switchport nonegotiate
