Lab Objective:
Learn how to configure MAC address filtering on a switch.
Lab Purpose:
MAC address filtering allows you to configure which addresses can be accepted through a port. This can be achieved through layer 2 access lists, firewalls, or (as in this instance) switch port security settings.
Lab Tool:
Packet Tracer
Lab Topology:
Please use the following topology to complete this lab exercise:
Lab Walkthrough:
Task 1:
Connect a hub to a switch and then two PCs to the hub. It won’t matter which ports you use, but connect to F0/1 on the switch from the hub using a crossover cable.
Task 2:
Configure IP addresses on the hosts as per the diagram. Here is the config on PC0:
Task 3:
Note the MAC address on PC1. Copy it. Please note that your MAC address will differ from mine.
Task 4:
Configure MAC address filtering on the switch. Enter the MAC address of PC1, which will be permitted on the port. If any other MAC address reaches the port, it will shut down.
Switch(config)#int f0/1
Switch(config-if)#switchport mode access
Switch(config-if)#switchport port-security
Switch(config-if)#switch port-security mac-address ?
H.H.H 48 bit mac address
sticky Configure dynamic secure addresses as sticky
Switch(config-if)#switch port-security mac-address 0006.2A15.6402
Switch(config-if)#end
Task 5:
Check the port security settings on the switch. The configured MAC address won’t show, but it will show when you issue a show run command. I’ve highlighted the most relevant parts of the output for you.
Switch#show port-security int f0/1
Port Security : Enabled
Port Status : Secure-up
Violation Mode : Shutdown
Aging Time : 0 mins
Aging Type : Absolute
SecureStatic Address Aging : Disabled
Maximum MAC Addresses : 1
Total MAC Addresses : 1
Configured MAC Addresses : 1
Sticky MAC Addresses : 0
Last Source Address:Vlan : 0000.0000.0000:0
Security Violation Count : 0
Switch#show run
Building configuration…
Current configuration : 1181 bytes
!
version 12.2
!
hostname Switch
!
interface FastEthernet0/1
switchport mode access
switchport port-security
switchport port-security mac-address 0006.2A15.6402
[output truncated]
Task 6:
Ping from PC0 to PC1. This will send frames through the switchport via the hub, triggering MAC filtering.
Task 7:
Issue the show port-security command to check the general port security settings on the switch. The interface should have gone down.
Switch#show port-security int f0/1
Port Security : Enabled
Port Status : Secure-shutdown
Violation Mode : Shutdown
Aging Time : 0 mins
Aging Type : Absolute
SecureStatic Address Aging : Disabled
Maximum MAC Addresses : 1
Total MAC Addresses : 1
Configured MAC Addresses : 1
Sticky MAC Addresses : 0
Last Source Address:Vlan : 0000.0CE0.A38C:1
Security Violation Count : 1
Task 8:
Check the MAC address of PC0 to ensure this was the one that triggered the port shutdown.
Note:
The only way to recover ports from the security shutdown is to manually ‘no shut’ them.
