| 2.5 |  | Securing Switches and LAN Access |
| 2.5.3 |  | Port security |

| Port security is a feature of the Catalyst Switches that allows a switch to block input from a port when the MAC address of a station attempting to access the port is different from the configured MAC address. When a port receives a frame, the port compares the source address of the frame to the secure source address that was originally learned by the port. If the addresses do not match, the port is disabled and the LED for the port turns orange.

By default, a switch allows all MAC addresses to access the network. It relies on other types of security such as file-server operating systems and applications to provide for network security. Port security allows a network administrator to configure a set of MAC addresses to provide additional security. If port security is enabled, only the MAC addresses that are explicitly allowed can use the port. A MAC address can be allowed as follows:

- Static assignment of the MAC address - The network administrator can code the MAC address when port security is assigned. This is the more secure of the two methods, but it is difficult to manage.
- Dynamic learning of the MAC address - If the MAC address is not specified, the port turns on learning for security. The first MAC address seen on the port becomes the secure MAC address.

Identity Based Network Services (IBNS)
Many switches now offer Identity Based Network Services (IBNS) through a series of 802.1x extensions. In stark contrast to the legacy, static access network ports discussed above, IBNS provides a new generation of network access in which intelligent network services are dynamically applied to user ports to improve security, mobility, and productivity. The IEEE 802.1x standard defines 802.1x port-based authentication as a client-server based access control and authentication protocol that restricts unauthorized clients from connecting to a LAN through publicly accessible ports. The authentication server validates each client connected to a switch port before making any services offered by the switch or the LAN available. Until the client is authenticated, 802.1x access control does not allow the user to transmit data.

With 802.1x port-based authentication, network devices have specific roles .

Client
The workstation that requests access to the LAN, switch services, and responds to requests from the switch is called the client. The workstation must be running 802.1x-compliant client software such as that offered with the Microsoft Windows XP operating system.

Authentication server
The authentication server performs the actual authentication of the client. The authentication server validates the identity of the client and notifies the switch whether the client is authorized to access the LAN and switch services. Because the switch acts as the proxy, the authentication service is transparent to the client. The Remote Authentication Dial-In User Service (RADIUS) security system with Extensible Authentication Protocol (EAP) extensions is the only supported authentication server. RADIUS is available in Cisco Secure Access Control Server (CSACS) version 3.0. RADIUS operates in a client/server model in which secure authentication information is exchanged between the RADIUS server and one or more RADIUS clients. CSACS will be covered in module 4.

Switch, or wireless access point
The switch controls physical access to the network based on the authentication status of the client. The switch acts as an intermediary, or proxy between the client and the authentication server, requesting identity information from the client, verifying that information with the authentication server, and relaying a response to the client. The switch includes the RADIUS client, which is responsible for encapsulating and decapsulating the EAP frames and interacting with the authentication server.