9.2 Port Security and MAC Address Limiting

Port Security and MAC Address Limiting

Quick Summary: Ethernet switches make forwarding decisions using a Content Addressable Memory (CAM) table that dynamically learns source MAC addresses arriving on physical interfaces. Malicious actors exploit this mechanism through CAM table flooding attacks, overwhelming switch memory with randomized MAC addresses to force the switch into a broadcast "fail-open" mode. Port Security and MAC Address Limiting mitigates this threat by capping the number of permitted MAC addresses on an interface; unauthorized clients are always blocked, and the violation action (notify or shutdown) decides whether the switch only reports the violation or also disables the port.

---

The MAC Address Table and CAM Flooding Attacks

To forward unicast frames efficiently, an Ethernet switch maintains a hardware-accelerated forwarding database known as the MAC Address Table or Content Addressable Memory (CAM) table. When a frame enters a physical port, the switch ASIC reads the Source MAC address and records it alongside the ingress port and VLAN ID. Future frames destined for that MAC address are switched directly out that specific port rather than flooded across the VLAN.

The Mechanics of CAM Table Flooding

Hardware CAM tables possess finite memory capacity (typically 8,000 to 64,000 MAC addresses depending on switch platform specifications, such as the Aruba CX 6100 vs. CX 6300). Attackers take advantage of this physical limitation using automated flooding tools (such as macof):

+---------------------------------------------------------------------------------------------------------+
|                                      CAM TABLE FLOODING ATTACK MECHANICS                                |
|                                                                                                         |
|     [ Attacker Workstation ]                                                                            |
|         | (Transmits 50,000 frames/sec with randomized Source MACs: 00:01:aa..., 00:02:bb...)           |
|         v                                                                                               |
|     [ Access Switch CAM Table ] ---> [ Full: 32,768 / 32,768 MACs Exhausted! ]                          |
|         |                                                                                               |
|         v                                                                                               |
|     [ Switch Enters Fail-Open State: Acts Like a Legacy Shared Hub ]                                    |
|         |                                                                                               |
|         +-----> Floods ALL Unicast Frames to All Ports in VLAN!                                         |
|         +-----> Attacker passively sniffs confidential user sessions, credentials, and traffic!        |
+---------------------------------------------------------------------------------------------------------+

1. High-Velocity Frame Transmission: The attacker floods the physical switch port with tens of thousands of Ethernet frames per second, each featuring a randomized, bogus source MAC address.
2. Table Saturation: The switch rapidly updates its CAM table, learning the bogus MACs until memory capacity is entirely exhausted. Legitimate dynamic host entries are aged out or overwritten.
3. The "Fail-Open" Condition: Once the CAM table is full, the switch cannot learn new addresses. When a legitimate frame arrives destined for an address missing from the CAM table, the switch must treat it as an unknown unicast frame. Standard Layer 2 behavior requires flooding unknown unicast frames out every port within the broadcast domain.
4. Passive Eavesdropping: By forcing the switch into this hub-like broadcasting state, the attacker connects a packet analyzer (such as Wireshark) and passively captures confidential traffic passing between other legitimate workstations, completely undermining Layer 2 privacy.

---

Port Security and MAC Address Limiting Principles

Port Security provides edge protection by restricting the number and identity of MAC addresses permitted to transmit traffic through a physical switch interface. It achieves three primary operational objectives:

• CAM Table Protection: Caps the maximum number of MAC addresses learned on any single port, ensuring that a single compromised endpoint cannot exhaust the entire switch forwarding table.
• Rogue Switch and AP Prevention: Prevents users from attaching unmanaged desktop switches, consumer Wi-Fi routers, or wireless extenders to cubicle wall jacks to connect unauthorized multiple devices.
• Physical Access Lockdown: Binds authorized device MAC addresses to specific physical ports, preventing unauthorized hardware from communicating if plugged into an enterprise network jack.

---

MAC Address Learning Modes: Dynamic, Static, and Sticky

Aruba AOS-CX port security supports three methods for defining and retaining authorized MAC addresses:

Sticky MAC Learning Mechanics

Sticky MAC learning delivers the convenience of dynamic learning combined with the security of static bindings. When an administrator enables sticky learning on an access port, the MACs learned on that port become sticky. If the switch reboots or the cable is disconnected, the port continues to permit only those MAC addresses, preventing an unauthorized user from disconnecting the corporate PC and attaching a rogue laptop. Moving a sticky client to a different port is itself a violation (show port-access security violation sticky-mac-client-move interface).

---

Violation Modes and Administrative Actions

A port security violation occurs when a frame arrives on a secured interface from a source MAC address that is not authorized and the port has already reached its client limit. On AOS-CX, port security always blocks the intruding device from sending traffic through the port; the configured action decides what else happens (AOS-CX 10.14 CLI and Security Guides):

+---------------------------------------------------------------------------------------------------------+
|                                    PORT SECURITY VIOLATION ACTIONS                                      |
|                                                                                                         |
|     [ Action: NOTIFY (default) ] ---> Intruder blocked; authorized clients keep working.                |
|                                       Event log entry + SNMP trap ("Client limit exceeded on port ...").  |
|                                                                                                         |
|     [ Action: SHUTDOWN ] -----------> Port is shut down; all clients on it lose service.                 |
|                                       Optional auto-recovery after a recovery timer.                    |
+---------------------------------------------------------------------------------------------------------+

Detailed Analysis of Violation Actions

1. notify (default):

   • Action: The unauthorized client is blocked, and the switch writes an event-log entry (for example, "Client limit exceeded on port 1/1/8, caused by an unauthenticated client ...") and sends an SNMP trap.
   • Impact: Authorized MAC addresses on the port continue to forward normally.
   • Use Case: Standard enterprise offices where the security team wants visibility without disrupting legitimate users.

2. shutdown:

   • Action: The switch shuts down the port where the client limit was exceeded.
   • Impact: All traffic stops on the port, including traffic from previously authorized endpoints and IP phones.
   • Recovery: Manual shutdown/no shutdown, or automatic recovery with port-access security violation action shutdown auto-recovery enable and port-access security violation action shutdown recovery-timer <seconds> (auto-recovery is disabled by default).
   • Use Case: High-security environments where any unauthorized connection indicates tampering.

Note: Other platforms offer a silent "protect" or "drop" mode. On AOS-CX the choice is only notify or shutdown; blocking the intruder happens in both.

---

AOS-CX Configuration Commands and Verification

The following configuration session enables port security globally and on a port, sets a client limit of 2 (an IP phone and a PC), enables sticky learning, and chooses the shutdown action with auto-recovery:

switch# configure terminal

! Step 1: Globally enable port security
switch(config)# port-access port-security enable

! Step 2: Configure Port Security on an Access Interface
switch(config)# interface 1/1/10
switch(config-if)# description Desk-10-PC-and-Phone
switch(config-if)# no routing
switch(config-if)# vlan access 10
switch(config-if)# port-access port-security enable
switch(config-if)# port-access port-security
switch(config-if-port-security)# client-limit 2
switch(config-if-port-security)# sticky-learn enable
switch(config-if-port-security)# exit
switch(config-if)# port-access security violation action shutdown
switch(config-if)# port-access security violation action shutdown auto-recovery enable
switch(config-if)# exit

! Step 3: Manual Recovery for a Shut-Down Port
switch(config)# interface 1/1/10
switch(config-if)# shutdown
switch(config-if)# no shutdown
switch(config-if)# exit

Essential Verification Commands

---

Port Security vs. Enterprise Network Access Control (802.1X)

It is vital for enterprise network engineers to understand the architectural boundary between basic port security and enterprise Network Access Control (NAC):

• Port Security Limitations: Port security operates strictly on unauthenticated Layer 2 MAC addresses. Because MAC addresses can be easily sniffed and spoofed by an attacker using free software utilities, port security does not provide cryptographic identity verification.
• Enterprise NAC (802.1X / ClearPass): Enterprise environments deploy IEEE 802.1X port-based authentication backed by Aruba ClearPass Policy Manager. 802.1X enforces cryptographic user credentials or digital certificates, role-based access control, dynamic VLAN assignment, and posture assessment, providing comprehensive Zero Trust access control.

---

Common Exam Traps

• Global Enablement Prerequisite: Port security must be enabled globally (port-access port-security enable in config context) as well as on the port. Omitting the global command is a frequent troubleshooting trap.
• Sticky Means Persistent: On AOS-CX, sticky-learned clients are not affected by a switch reboot or link flap. Disabling sticky learning turns them back into dynamic clients.
• Shutdown vs. Notify: The exam frequently tests which violation action keeps authorized devices working. shutdown disables the entire port (cutting off all users), whereas notify (the default) blocks only the intruder and reports the violation.