Port Security and 802.1X Network Access Control

This document provides a comprehensive overview of port security measures and the 802.1X standard, crucial components for maintaining network confidentiality, integrity, and availability. It details various configurations, operational modes, and the underlying mechanisms that enhance network security at Layer 2.

Overview of Network Security Mechanisms

Network security is paramount for protecting sensitive information and ensuring continuous operation. Two fundamental mechanisms discussed are Port Security and 802.1X, both designed to control access to network resources at the switch port level. Additionally, the concept of Simple Network Management Protocol (SNMP) traps is introduced as a notification mechanism for network events.

Simple Network Management Protocol (SNMP) Traps

An SNMP trap is a specific type of Protocol Data Unit (PDU) that represents an unrequested message sent to a network administrator. These messages are generated by managed devices to report significant events or changes concerning objects within the device, providing real-time alerts about potential issues or security violations.

Learning Objectives

The learning objectives for this module are structured to equip individuals with the knowledge and skills necessary to implement and troubleshoot network security measures effectively.

Terminal Learning Objectives

Network Security Maintenance (2651-COMM-1001): With appropriate references, mission tasking, authorization, permissions, and access to an intelligence network, individuals will be able to conduct network security operations to maintain network confidentiality, integrity, and availability in adherence to existing security policies and standards.
Switching Configuration (2651-COMM-1010): With appropriate references, mission tasking, authorization, access, permissions, and equipment, individuals will be able to configure switching on intelligence networks to establish communications between devices within an intelligence network within commander-allotted timeframes.

Enabling Learning Objectives

Layer 2 Security Identification (2651-COMM-1001c): Without references, individuals will identify Layer 2 security measures with at least 80 percent accuracy using testing materials.
Port Security Configuration (2651-COMM-1001d): With references, individuals will configure port security measures on network components with at least 80 percent accuracy.
Layer 2 Connection Components Identification (2651-COMM-1010e): Without references, individuals will identify the components of Layer 2 connections with at least 80 percent accuracy using testing materials.
Switching Issue Troubleshooting (2651-COMM-1010f): With references, given a scenario and network devices, individuals will troubleshoot switching issues with at least 80 percent accuracy.

Port Security

Port security is a Layer 2 security feature implemented on network switches to enhance security by controlling which devices can connect to specific switch ports. It achieves this by limiting the number and identity of Media Access Control (MAC) addresses allowed on a port.

Key Functions of Port Security

Implementing port security on switch ports allows administrators to:

Specify Allowed MAC Addresses: Define which specific MAC addresses are permitted to send traffic through a port.
Specify MAC Address Limit: Control the maximum number of MAC addresses that can be learned or configured on a single port.
Specify Port Actions: Determine the action the switch takes if an unauthorized MAC address is detected or if the MAC address limit is exceeded.

Enabling Port Security

Port security is enabled on a specific interface using the following command in interface configuration mode:

Switch(config-if)#switchport port-security

Types of Secure MAC Addresses

Port security supports different methods for managing secure MAC addresses, each with distinct characteristics regarding how MAC addresses are learned and stored.

Static Secure MAC Addresses

Static secure MAC addresses are manually configured by the network administrator. These addresses are explicitly defined for a specific port. Once configured, they are stored in the switch's MAC address table and are also added to the running configuration of the switch, ensuring their persistence across reboots.

Configuration Command:

Switch(config-if)#switchport port-security mac-address 00e0.b003.cbb4

Dynamic Secure MAC Addresses

Dynamic secure MAC addresses are learned automatically by the switch when a device connects to a port. These addresses are stored only in the switch's MAC address table. A key characteristic of dynamic secure MAC addresses is that they are removed from the address table when the switch restarts, requiring them to be re-learned upon subsequent device connections.

Configuration Command:

Switch(config-if)#switchport port-security mac address dynamic

Sticky Secure MAC Addresses

Sticky secure MAC addresses combine the advantages of both dynamic and static methods. Ports dynamically learn MAC addresses from connected devices, similar to dynamic secure MAC addresses. However, once learned, these MAC addresses are then saved to the running configuration of the switch. This provides the simplicity of dynamic discovery while offering the "permanence" of static MAC addresses, as they are stored in NVRAM and persist across switch reboots.

Configuration Command:

Switch(config-if)#switchport port-security mac-address sticky

Port Security Violation Modes

When a port security violation occurs (e.g., an unauthorized MAC address is detected or the maximum allowed MAC addresses are exceeded), the switch can be configured to react in one of three violation modes:

Protect Mode

In Protect mode, when the number of secure MAC addresses reaches the configured limit on the port, any subsequent packets originating from unknown source MAC addresses are dropped. The key characteristic of this mode is that no notification or alert is sent to the administrator when a violation occurs.

Configuration Command:

Switch(config-if)#switchport port-security violation protect

Restrict Mode

The Restrict mode also drops packets with unknown source addresses once the secure MAC address limit is reached. However, unlike Protect mode, Restrict mode provides notification of the violation. When a violation occurs, an SNMP trap is sent to the network administrator, a syslog message is logged, and a violation counter for the port is incremented. This provides visibility into security incidents.

Configuration Command:

Switch(config-if)#switchport port-security violation restrict

Shutdown Mode

Shutdown mode is the most stringent violation mode. If a port security violation occurs, the interface immediately enters an "error-disabled" state, effectively shutting down the port and turning off its LED indicator. Similar to Restrict mode, notification of the violation is sent to the administrator. The port must be manually re-enabled by an administrator (e.g., using the shutdown and then no shutdown commands) after the issue is resolved.

Configuration Command:

Switch(config-if)#switchport port-security violation shutdown

Port Security Configuration Example

Here is an example of configuring port security on a FastEthernet 0/1 interface:

Switch(config)#interface fa0/1
Switch(config-if)#switchport port-security
Switch(config-if)#switchport port-security mac-address sticky
Switch(config-if)#switchport port-security maximum 2
Switch(config-if)#switchport port-security violation shutdown

This configuration enables port security on interface fa0/1, configures it to learn MAC addresses dynamically and save them as sticky entries, sets the maximum allowed MAC addresses to two, and specifies that the port should shut down if a violation occurs.

Securing Unused Ports

A critical security practice is to secure switch ports that are not actively being used. These ports should be set to an administratively down state using the shutdown command. This prevents unauthorized users from simply plugging devices into an unused port and gaining illicit access to the network, thereby mitigating a common entry point for security breaches.

802.1X Port-Based Network Access Control

802.1X is an IEEE standard for port-based network access control, primarily used to provide authenticated access to network resources. While often associated with wireless networks, it can also be implemented on wired networks. It is described as the wireless equivalent of 802.1Q in terms of its foundational role in access control for wireless LANs.

Key Characteristics of 802.1X

Port-Based Access Control: It controls access to a network port (physical or virtual) until the user or device is authenticated.
Authentication Key Lifetime: It shortens the lifetime of authentication keys, enhancing security by frequently refreshing cryptographic material.
Extensible Authentication Protocol (EAP): 802.1X acts as a transport mechanism for EAP messages, which carry the actual authentication information between the client and the authentication server.

802.1X Authentication Process

The 802.1X authentication process involves three main components:

Supplicant: The client device (e.g., a laptop, smartphone) attempting to gain network access.
Authenticator: The network device (e.g., a wireless access point or switch) that controls physical access to the network. It acts as an intermediary between the supplicant and the authentication server.
Authentication Server: Typically a RADIUS (Remote Authentication Dial-In User Service) server, which performs the actual authentication of the supplicant's credentials.

The authentication process unfolds in a series of steps:

EAP-Request/Identity: As soon as the authenticator detects that a link is active (e.g., a device connects to a port), it sends an "EAP-Request/Identity" packet to the supplicant, requesting its identity.
EAP-Response/Identity: The supplicant responds by sending an "EAP-Response/Identity" packet to the authenticator. The authenticator then encapsulates this response and forwards it to the authentication (RADIUS) server.
Authentication Challenge: The authentication server processes the supplicant's identity and sends back an authentication challenge to the authenticator.
EAPOL Encapsulation: The authenticator unpacks the challenge from its IP encapsulation, repackages it into an EAP over LAN (EAPOL) frame, and sends it to the supplicant.
Authentication Method: EAP supports various authentication methods, including client-only authentication and strong mutual authentication. For wireless scenarios, strong mutual authentication, where both the client and the server authenticate each other, is considered the appropriate and more secure approach.
Supplicant Response: The supplicant responds to the challenge via the authenticator, which then passes this response onto the authentication server.
Authentication Success: If the supplicant provides proper identity and successfully meets the challenge, the authentication server responds with a success message. This message is then forwarded by the authenticator to the supplicant.
Network Access Granted: Upon receiving the success message, the authenticator allows the supplicant full access to the Local Area Network (LAN).

802.1X Authentication Flow Diagram Description

The provided diagram visually represents the 802.1X authentication flow, illustrating the interactions between the Supplicant, Authenticator, and Authentication Server through 11 distinct steps:

EAPoL Start: The supplicant connects to the LAN and initiates communication to identify the authenticator.
EAP Request ID: The authenticator sends an EAP Request for Identity to the supplicant.
EAP Response: The supplicant responds by identifying itself.
Authenticator Forwards RADIUS Access Request: The authenticator encapsulates the supplicant's identity and forwards it as a RADIUS Access-Request to the authentication server.
RADIUS Issues Access Challenge: The RADIUS server processes the request and issues an access challenge back to the authenticator.
Authenticator Sends EAP Request: The authenticator forwards the EAP challenge to the supplicant.
Supplicant Requests Authentication Method: The supplicant may request a specific authentication method.
Authenticator Passes Authentication Method Request: The authenticator relays the supplicant's preferred authentication method to the RADIUS server.
New RADIUS Access Challenge Issued: The RADIUS server issues a new access challenge, potentially tailored to the preferred authentication method.
Access-Accept Sent: Once the supplicant's identity is verified and authentication is successful, the RADIUS server sends an Access-Accept message to the authenticator.
Success Message Sent, Port Opened: The authenticator sends a success message to the supplicant, and the network port is opened, granting the supplicant access to the network.

Summary

Port Security and 802.1X are critical Layer 2 security mechanisms that provide granular control over network access. Port Security focuses on limiting and identifying MAC addresses allowed on a switch port, offering various violation responses from silent dropping to port shutdown. 802.1X provides a robust, port-based authentication framework, leveraging EAP and a RADIUS server to ensure only authenticated devices gain network access, particularly vital in wireless environments. Together, these technologies form a strong defense against unauthorized network access and enhance overall network integrity.