Enable password vs Enable Secret

enable secret password provides encryption automatically using MD5 hash algorithm. The enable password password does not encrypt the password and can be view in clear text in the running-config. In order to encrypt the enable password password , use the service password-encryption command. To be clear, the enable secret password command provides stronger encryption than the service password-encryption command.

Example of enable password vs enable secret;

Switch(config)#enable secret cisco123
Switch(config)#do sh run | in enable
enable secret 5 $1$WMOj$nNNoJr4ybae7mHiCBA3dT1

Switch(config)#enable password cisco456
Switch(config)#do sh run | in enable
enable secret 5 $1$WMOj$nNNoJr4ybae7mHiCBA3dT1
enable password cisco456

Switch(config)#service password-encryption
Switch(config)#do sh run | in enable
enable secret 5 $1$WMOj$nNNoJr4ybae7mHiCBA3dT1
enable password 7 121A0C04110458517C

Switch(config)#username test privilege 15 secret test
Switch(config)#do sh run | in username
username test privilege 15 secret 5 $1$/x1j$ZlezpapESt7tMio2c5jpE.

Switch(config)#username test2 privilege 15 password test2
Switch(config)#do sh run | in username
username test privilege 15 secret 5 $1$/x1j$ZlezpapESt7tMio2c5jpE.

username test2 privilege 15 password 7 001016151009

MACsec L2 Hop by Hop encryption

Protect packets on a switch links at layer 2 using MACsec.
traffic (CDP, IP packets, etc)  is encrypted and provides data integrity, confidentiality,

Cisco Trust Sec - CTS is a method to implement open standard MACsec.


on interfaces, issue command "CTS manual" which is manually configuring MACsec on them.
When done manually, need to specify the Security Association Protocol  Pairwise master Key (SAP PMK) which is a encryption key used to encrypt traffic.

Eavesdropper without a proper key wont be able to decrypt the protected traffic.


Example of encrypting traffic between SW 2 and SW4.   CDP traffic is blocked until MACsec is configured both sides.

peer identity unknown due to MACSec is not set on other side.

Port based access control list

Block incoming or outgoing traffic on a port.

PACL is applied to an interface.


Example of PACL called NO-PING-TO-11 to deny destination IP address 10.123.0.11

VLAN Access control list - VLAN Maps

Traffic not crossing router but traffic within VLAN on switch can be filtered.
All ports in the VLAN are enforced by VLAN access control list.  To have end to end VLAN traffic filtering, the VLAN maps needs to be configured on those switches.

Identify with permit statement ACLs (IP, MAC) then use VLAN maps to match the ACLs to drop packets

By default , VLAN map has implicit deny at end and all traffic will stop so traffic permit ACL is required

Protected Ports - Private VLAN Edge

Use Protected ports to isolate protected ports from other protected ports but allow traffic to unprotected ports.  Use when Private VLANs are not necessary.

Example of protected ports blocked between protected ports and unprotected ports.

Ping from protected ports 10.123.0.3 and 10.123.0.4 are blocked but ping to unprotected port of device 10.123.0.1 is allowed.  

interface GigabitEthernet0/2\
Description *** Device 10.123.0.3 connected to protected port ***
 switchport access vlan 123
 switchport mode access
 switchport protected
!
interface GigabitEthernet0/3
Description *** Device 10.123.0.4 connected to protected port ***
 switchport access vlan 123
 switchport mode access
 switchport protected

L2 port security

L2 port security to mitigate CAM table overflow attack

A switch has a cache limit to store MAC address of devices connecting to the switch.  This cache can be overloaded and causing MAC lookups to fail.


Switch can store MAC address as dynamic, static and sticky.

• dynamic entries MACs are stored in the table as device are recognized
• static MAC entries are defined manually and stored in running configuration and written to startup configuration with Write Memory or Copy Running Start command
• sticky MAC entries are dynamic entries that are stored in running configuration and written to startup configuration with Write Memory or Copy Running Start command
• default number of MAC address learned is 1.

Violation actions are

• Protect - which silently blocks traffic and not reports the violation
• Restrict - which blocks and reports violation via snmp, syslog, counters
• Shutdown - Default.  Shutdown port and reports violation via snmp, syslog, counters
• Shutdown the vlan

Access or trunk ports needs to be static ports (ie. Switchport mode access or trunk) . Trunks accounted for more MAC entries than an access port.

Example of configuring port security on a static access port. 

Maximum address learned are 5. Aging type set to inactivity of 5 minutes which dynamic MAC addresses are aged out.  Port violation action is to restrict.  A static mac address is configured

Result of port security violation.

Example of configuring a port security on a trunk with a 50 learned MAC address for VLAN 123 only.

interface GigabitEthernet0/1
 switchport trunk encapsulation dot1q
 switchport mode trunk
 switchport port-security maximum 50 vlan 123
 switchport port-security

Cisco Network Storm Contol

What is Storm control?

Monitors broadcasts, multicasts, and unicast traffic.

You set thresholds on % (percentage) , PPS (packet per second), BPS (Bits per second)

Actions that can be set are to use STP (Spanning tree protocaol) , slow it down or shutdown the ports by error disabling it (err-disable)

Example of broadcast storm.  Notice packet counter increasing and High CPU process.

Ping causing ARP broadcast storm with STP disabled for VLAN 50.  Network is saturated and unable to access nodes on the network. Simple ping to a node fails.

In addition to using STP, use storm control to mitigate broadcast storms:

Example of storm-control broadcast minimum limit and maximum limit threshold based on pps.

Packets clipped when maximum is reached and stops clipping when minimum is reached.

Error recovery is used to recover from storm control err-disabling the ports.