Wired network infrastructure should have Port Security enabled and configured to restrict access to switchports.

Control Type: Technical

Control Function: Preventive

Even in wireless native work environments, there is going to be a wired backbone infrastructure in some form. Servers, access points, IoT devices, security cameras, etc all need to have wired links to perform optimally.

It is impossible to always monitor the use of wired switchports, so what is to stop an adversary from entering the facility, unplugging an exposed device from a wall jack or switch, and plugging in their own device to gain network access? Port Security is a feature that has emerged to mitigate this risk.

Port Security allows administrators to specify specific MAC addresses on a per switchport basis. If a device connects to the port that doesn’t have the specified MAC address, the port ceases to function properly, preventing potential adversaries from getting any network access.

The typical logic sequence for Port Security is as follows:

  1. Examine incoming frames on the interface, noting the source MAC address.
  2. Define a maximum number of unique source MAC addresses to be allowed for the interface
  3. Track and keep count of all the MAC addresses
  4. Continue monitoring MAC addresses and cause a violation if a new MAC pushes the total learned MAC addresses past the maximum
  5. Take a variety of pre-specified actions to discard violating frames

There are three methods for using Port Security:

  1. Static: permitted MAC addresses are pre-defined by an administrator. The specified MAC addresses are added to the running config and persist across reboots.
  2. Dynamic: MAC addresses are automatically learned by the switch. They are stored in the MAC address table and expire after a set interval. The configuration is not persistent.
  3. Sticky: MAC addresses are dynamically learned and then written to the running configuration as if they are static entries. The configuration persists in the running config. Think of this as a hybrid of Static and Dynamic Port Security.  

Port Security allows selection from three different Violation Modes. These specify what action is taken if a port security violation occurs (maximum MAC addresses are exhausted, and a new MAC sends a frame).

  • Protect: discards the offending network traffic
  • Restrict: discards the offending network traffic and sends logging information and an SNMP message.
  • Shutdown: discards the offending network traffic, sends logging data and SNMP messages, and then disables the switchport by placing it in an err-disable state

Shutdown is the most extreme violation mode. A switchport placed in err-disabled state must be re-enabled by an administrator using the commands shutdown and then no shutdown.