1

So I have been playing around with Cisco IOS devices for a number of years. I have mostly done configurations on Catalyst 2960 devices a little experience with layer 3 switches.

I have decided to study for my CCNA using online resources, as convenient as they are that are times when you have questions that cannot be answered because there is not a live person there.

My question is regarding port security.

Generally for ports in our environment that are unused we just shut them down.

The instructor on the video series I am using suggests putting them into access mode and then assigning a go nowhere VLAN.

I understand the potential issues with having the port in a non dedicated state (access/trunk) but with the port just shut off does that eliminate the concern without extra typing.

Is this a personal preference thing or is there school of thinking behind this that I am not seeing.

Thanks for your opinion and thoughts.

9 Spice ups
2

My personal preference and the one I’ve implemented is that if it’s not in use, it’s shut down. That way, if someone plugs in something they shouldn’t - there isn’t an issue. If I need to find free ports I can just look at which ports are shutdown. I just find it easier and safer.

1 Spice up
3

I just finished my CCNP and it looks like the consensus is, shut them down

1 Spice up
4

I could see the potential of leading them down a path to nowhere. Think of it this way:

Physical locks were never meant to be the be-all-end-all of security devices. They’re just there to slow a perp down, hopefully, long enough to make the attempt not worth taking the time. Any thief with enough will, tools, and opportunity will always be able to crack it. Same with someone breaking into your house. Someone with a sledge hammer or a big enough battering ram combined with enough time and brute force will be able to get through it. But, if you have a man-catcher behind it, a bunch of hallways that go nowhere, doors that open on to blank walls, and trap doors in the floors that keep bringing them back to the beginning, they may actually give up, eventually.

The same can be said with such open, but blank, ports. If someone wants to get in, they’ll find a way. Even if you have ports that are shut off, that only tells them where not to go. But, if you send them on a wild goose chase at every turn, they may give up before they hit the right passage way.

Certainly not the best way to do it, I’ll give you that much. But, this may be one explanation why there are some who advocate for such a practice. Wouldn’t use it, myself, either. Too many things to go wrong. But, I can see the appeal of effing with an attacker and feeding their frustration. Think of it as a kind of very passive-aggressive form of vengeance.

:wink:

1 Spice up
5

Dead end ports will go up/up. Set a syslog to trap the event and email an alert. Then you get a chance to go speak to the individual concerned and remind them of the IT policy…

1 Spice up
6

I shut the ports down. And I put them in vlan 1 - which goes nowhere. Why? Because if I (or some well-meaning tech) accidently changes a port assignment or enables it, nothing happens. They have to make two mistakes for something undesired to happen.

Plus, in the utility I use to display switch configs, it stands out to see the “1” in the vlan tag.

Plus, by forcing the tech to make two steps to properly disable a port, it also makes them think twice and serves as a double check.

4 Spice ups
7

Different organisations have different cultures on this.

Working in a large environment where each active switchport represented $$$ spent, and where I had to fight tooth and nail for more $$$ if I needed more switchports, I always shut down and unpatched unused ports.

Other organisations (usually smaller) are happy buying way more switchports than they need, floodpatching everywhere, and leaving them all on, so that people could be moved around without pestering IT.

The new-fangled way of doing things is for ports to default to a sin-bin VLAN unless the device or user have authenticated to a particular network and then passed various security checks to be put into their home VLAN. The good thing about having active ports in this scenario is that a proper connection can be automatically enabled (good for the user and less work for the service desk) in seconds, and an improper connection is immediately flagged to security.

8

DOT1X is not exactly “new fangled”. It’s been around for over a decade…