you NEED to learn Port Security…….RIGHT NOW!! // FREE CCNA // EP 14

About this video

Episode 14 of the creator’s free CCNA series uses a Hack5 Shark Jack plugged into an exposed wall jack to motivate switch port security. He explains the device runs Linux, can obtain an address via DHCP, learn the subnet, gateway and DNS, and run a scripted scan such as Nmap, sending results out, for example via Slack. Defenses are layered: administratively shut down every unused Cisco port (shown with configure terminal and ‘shut’, verified as administratively down) or disable the profile in UniFi; place unused ports in a ‘black hole’ VLAN with no DHCP, gateway or device-to-device access, illustrated as VLAN 666; and enable port security on ports that are in use so only an allowed MAC address works. On Cisco he hardcodes switchport mode access, enables switchport port-security, sets a maximum of one MAC (two when an IP phone plus PC share a port), uses the sticky option to learn and retain the first device’s MAC, and sets violation to shutdown. A violation puts the port in err-disabled, recovered with shut followed by no shut. He notes UniFi offers a MAC allow-list without sticky, and mentions 802.1X, certificates and Cisco ISE as more advanced enterprise options.

Key takeaways

• An exposed live jack can give an attacker DHCP, network details and reachability to scan other hosts, as demonstrated with the Shark Jack’s Nmap payload.
• Shut down all unused switch ports administratively on Cisco, or disable their profile in UniFi, so plugging in a device cannot bring them up.
• Put ports that must stay up but unused into a black-hole VLAN with no DHCP, no gateway and ideally device isolation, and keep that VLAN off trunks.
• Configure Cisco port security with access mode, a MAC maximum, sticky learning or an explicit MAC, and violation shutdown to bounce unauthorized devices.
• A port-security violation leaves the port err-disabled rather than admin-down; verify with show port-security and recover it with shut then no shut.

Episode details: published July 30, 2021 · 23:23 long. Summary written by Self Growth Videos from the episode itself. Business results and any income figures mentioned are NetworkChuck’s own claims, shared for education — they are not typical or guaranteed.

← Previous: access EVERYTHING from your web browser!! (Linux and Windows Desktop, SSH) // Guacamole Install · Next: start, stop, restart Linux services (daemon HUNTING!!) // Linux for Hackers // EP 6 →

All NetworkChuck videos · NetworkChuck profile · NetworkChuck on YouTube