Cyberstudy
PDF p.123 In progress

Port Security

Open PDF at p.123 22 flashcards

Summary

PDF p.123

Port security involves securing wall and switch ports to prevent unauthorized devices from connecting to the network. Methods include physical security measures, MAC filtering, and 802.1X authentication. These measures help protect the network from various attacks by ensuring only authorized devices and users can access network resources.

In plain words

Supplementary — not from your PDF

Port security stops unauthorized devices from joining the network through a wall or switch port. Options are physical measures (locked rooms, disabled unused ports), MAC filtering and limiting on the switch, and, best of all, 802.1X, which requires the device or user to authenticate before the port opens fully.

Detailed explanation

PDF p.123
  • Physical Security Measures
    • Restricted Access: Limit access to physical switch ports and hardware to authorized staff.
    • Secure Locations: Place switch appliances in secure server rooms or lockable cabinets.
    • Disable Ports: Administratively disable switch ports or remove patch cables to prevent unauthorized connections.
    • Limitations: Complete port disabling can be administratively burdensome and not foolproof.
  • MAC Filtering and MAC Limiting
    • MAC Address Identification: Each host computer's network adapter has a unique MAC address.
    • MAC Filtering: Configure switch ports to permit only certain MAC addresses.
    • MAC Limiting: Specify a limit to the number of permitted MAC addresses per port.
    • Example: Enable port security with a maximum of two MAC addresses; the switch records the first two MACs and drops traffic from other MAC addresses.
  • 802.1X and Extensible Authentication Protocol (EAP)
    • Challenges with MAC Filtering: Difficult to manage and prone to spoofing.
    • 802.1X PNAC Standard: Requires authentication before granting full network access.
    • AAA Architecture
      • Supplicant: Device requesting access (e.g., user's PC or laptop).
      • Authenticator: Switching device acting as a conduit for authentication data.
      • Authentication Server: Validates authentication requests, issues authorizations, and performs accounting.
    • Protocols
      • EAP: Framework for multiple authentication methods, often using digital certificates.
      • RADIUS: Allows communication of authentication and authorization decisions between authenticator and authentication server.
    • Authentication Process: Host connects to 802.1X-enabled switch port, switch opens port for EAPoL protocol, sends encrypted EAP packet to authentication server via RADIUS, server validates credentials, and grants full network access if successful.

Important terms

taken from the text above
Restricted Access
Limit access to physical switch ports and hardware to authorized staff.
Secure Locations
Place switch appliances in secure server rooms or lockable cabinets.
Disable Ports
Administratively disable switch ports or remove patch cables to prevent unauthorized connections.
MAC Address Identification
Each host computer's network adapter has a unique MAC address.
MAC Filtering
Configure switch ports to permit only certain MAC addresses.
MAC Limiting
Specify a limit to the number of permitted MAC addresses per port.
Challenges with MAC Filtering
Difficult to manage and prone to spoofing.
802.1X PNAC Standard
Requires authentication before granting full network access.
Supplicant
Device requesting access (e.g., user's PC or laptop).
Authenticator
Switching device acting as a conduit for authentication data.
Authentication Server
Validates authentication requests, issues authorizations, and performs accounting.
EAP
Framework for multiple authentication methods, often using digital certificates.
RADIUS
Allows communication of authentication and authorization decisions between authenticator and authentication server.
Authentication Process
Host connects to 802.1X-enabled switch port, switch opens port for EAPoL protocol, sends encrypted EAP packet to authentication server via RADIUS, server validates credentials, and grants full network access if successful.
EAP Extensible Authentication Protocol

Examples & real-world scenarios

Supplementary — not from your PDF
  • Disabling unused switch ports in a lobby.
  • Limiting a port to two MAC addresses.
  • 802.1X: the laptop (supplicant) authenticates through the switch (authenticator) to a RADIUS server (authentication server) using EAP.

Scenario

A visitor plugs a laptop into a meeting room port. With 802.1X, the port only passes EAPoL authentication traffic, so the laptop gets no network access without valid credentials or a certificate.

Common mistakes

Supplementary — not from your PDF
  • Relying on MAC filtering alone. MAC addresses are easy to spoof and the lists are hard to manage.
  • Mixing up the 802.1X roles: the switch is the authenticator, not the authentication server.

Practical skills

Supplementary — not from your PDF
  • Name the three 802.1X roles and what each does.
  • Choose between physical, MAC-based and 802.1X port security.

What I should remember

Key Points PDF p.123
  • Physical Security Measures
    • Restricted Access: Authorized staff only.
    • Secure Locations: Server rooms, lockable cabinets.
    • Disable Ports: Administrative disabling, patch cable removal.
    • Limitations: Administrative overhead, not foolproof.
  • MAC Filtering and MAC Limiting
    • MAC Address Identification: Unique MAC addresses.
    • MAC Filtering: Permit specific MAC addresses.
    • MAC Limiting: Limit number of MAC addresses per port.
    • Example: Maximum of two MAC addresses.
  • 802.1X and EAP
    • Challenges with MAC Filtering: Management, spoofing.
    • 802.1X PNAC Standard: Authentication before access.
    • AAA Architecture: Supplicant, authenticator, authentication server.
    • Protocols: EAP, RADIUS.
    • Authentication Process: EAPoL protocol, encrypted EAP packet, RADIUS communication, credential validation.