Free CCNA | Port Security | Day 49 | CCNA 200-301 Complete Course

[@steve-harveyy]

He protec He attac He stop network attac

[@JeremysITLab]

pinned 😂

[@aazzam4165]

hero 🤣🤣🤣🤣🤣

[@parker73724]

Congrats Steve Harveyy. You win my award for favorite comment of the course so far.

[@AndroidTap]

I get a rush of serotonin every time he says '...but you don't need to remember this for the ccna.'

[@misterribal]

Just passed the CCNA with a 983 score! Thanks Jeremy, I am at a uni and this will definitely help me when I'll be searching for my first job.

[@JeremysITLab]

Awesome, congrats! That's an awesome score. Best of luck in your future studies and career

[@devilsadvocate2163]

983?? That is freaking brilliant man!!! Do you mind sharing with us what resources you used to obtain that grade? And did you buy any practice exams?

[@crihala]

@@devilsadvocate2163 Nobody will replay after they successed with their exam :) That's human nature..

[@llllll-ux2lz]

How amazing are you! Way to go!

[@ZerohourTV]

how many questions was the exam, and is it all multiple choices? or there is writing code in it? would love an answer if you can

[@carlosenriquelopezperez7269]

Jeremy, I really want to thank you, I am taking a CCNP ENCOR course in an academy, after 4 classes, I have seen everything you teach here, now I understand how complete this course is, that in a way, it leads you to the CCNP, it really takes you I congratulate you, for your work and effort, you are the best.

[@stunr1887]

Hello Jeremy, I passed the CCNA on 07/09/21. Thank you for all the help with your amazing course. I supplemented your course with Wendell Odom's CCNA guide and passed on the first try. I will definitely be subscribing to show my appreciation.

[@riamu1985]

Hi were u new to networking or did u have some experience??

[@arashshafieyan4647]

Thank you very much Jeremy . There is no doubt that you are one of the best CISCO instructors.

[@JeremysITLab]

Thank you, Arash :)

[@sanskarsingh9538]

You are an angel sent by the gods. You cover things more than just CCNA. You cover important off topics as well. You have my respect!

[@fredharris1049]

I passed my CCNA exam in part by watching your videos. Thank you for your work.

[@Michael-yl9rl]

❤❤❤ I already pass the CCNA, but still I'm watching Jeremy's videos. The best CCNA Guru ever....

[@DreadNought-n2b]

How big was the syllables for the exam?

[@Michael-yl9rl]

@@DreadNought-n2b if you watched all Jeremy's videos, the course is not complete yet...I think this is about 80% complete. Wait till Jeremy finish all the topics so you can be sure to pass otherwise you need to do your own research on those topics not yet covered...automation, security and wireless topics...download the exam topics for CCNA from Cisco.com for your reference. Also Jeremy has a link showing which topics he already covered. Master Ip routing, static and dynamic.....ospf configuration....LACP PAGP also came up...

[@DreadNought-n2b]

@@Michael-yl9rl 😢😢😢 wow, was hoping on someone shedding more light, cause I was comparing the time limit it'll take for that or a software developer, but with your ccna, one can earn a standard salary (not minimum wage or something close to working in a gas station?)

[@maircosta422]

I have ccna in two days, and im so sorry I didnt find ur videos sooner! I get three chances and so if I dont pass first time, i know its ok because ill learn from you and be proficient on the fundamentals of networking. great great content. thx

[@Horidz]

Soo, how'd you do? It as intimidating as they make it seem?

[@maircosta422]

I failed actually. Im repeating it next monday

[@Horidz]

@@maircosta422 youll kill it the 2nd time. What did you use to study the 1st time around? Did you lab alot as well?

[@Horidz]

@@maircosta422 hey did you pass the 2nd time around?

[@maircosta422]

Tysm for asking. I did pass! Yes, labs are important. I got trunking, subnetting a /24 to a /28 and etherchannel.

[@benjaminazu-crabbe3818]

Jerry is Great..trust me you helping alot of guys out there..your tutorial are simple and detailed

[@tg9460]

I cannot thank you enough Jeremy. Your videos are amazing.

[@thomasploutonas4065]

Thanks again for a great lesson

[@hope6176]

The great jeremey 🙏, you are really great. Waiting for you are ccnp videos.

[@parker73724]

Port security is such a scary feature because you know you're going to get a million helpdesk tickets from people saying "the ethernet port broke itself". I think one of the hardest things about an IT job is trying to maintain a secure, available network without upsetting end users that don't know anything about how it works. At my previous job these kinds of things caused a lot of hostility towards the IT department.

[@wwolfram33]

Great lesson! I like how you explain the importance of status values and how they will behave in real world situations. Thanks!

[@Mikaiii]

Thanks for the awesome videos - I'm about to take my CCNA soon and just rewatching your videos once more and applying what I learned through my other resources. Also, small thing I noticed, there's a bird of some kind that you can hear crowing at the 5:06-5:07 timestamp. I just noticed it and thought it was funny lol

[@jksplaylist2721]

Hi, Jeremy! Many thanks to your channel for these amazing videos. I just realized you missed explaining how to configure the maximum mac address allowed on the port. I googled it though and tried it on PT.

[@jksplaylist2721]

The command I used is SW1(config-if)# switchport port-security maximum 2

[@-b777ljq3]

it's a very good lecture, thorough, in depth, and in detail, quiz is very good.

[@Saksham0412]

An access port can have only one VLAN configured on the interface; it can carry traffic for only one VLAN. A trunk port can have two or more VLANs configured on the interface; it can carry traffic for several VLANs simultaneously.

[@paulroberts8542]

I don't know if it was omitted on purpose but the 'switchport port-security maximum ' is important. You refer to the default maximum being one MAC address and refer to cases - such as supporting IP phones - when more than one is needed. But you don't show how to increase the maximum.

[@cesarbrenner5146]

One of the subjects I was waiting for your explanation.goood

[@am50405]

Mind blowing very-very details and easy to understand thank you sir

[@straightpath3800]

Jeremy is the King for real. we love you.

[@franksoko02]

Thanks for making learning fun Jeremy.

[@godfreyjustinian9935]

Thank Jeremmy for your tutorials, i really appreciate.

[@michaelhier3081]

Great lessons, have watched all of them so far :) Will you also be doing a CCNP ENCOR course in the future, if not for free then to purchase?

[@bernymartinez1025]

Great lessons jeremy.

[@prafulchandarana3137]

Hi Jeremy, I have a question after viewing Day 49 (Port security) and day 20-22 (STP/RSTP). How Port security work with STP/RSTP as the the network path is automatically reconfigured in case of failure of one link in the network? Hope my question is clear.

[@eljondee6109]

I think you forgot to teach us the command to configure a maximum mac address to be allowed. Thanks!

[@olawoleabiola7909]

Thank you Jeremy, your videos are amazing

[@Ali-1A295]

Thanks very much for this wonderful videos Please could you explain the changes in the Cisco certs ? Thank you 💞

[@リンゴ酢-b8g]

protected is more restricted than restrict!

[@abdallahelshuraydeh1697]

Can't thank you enough for such an amazing course, Jeremy! I have a question though, in this lecture, you say at first: by default secure MAC addresses will not 'age out', and later on you say: by default only dynamically-learned secure MAC addresses will age out. Can't seem to find what I had missed there!

[@JeremysITLab]

If aging of secure MAC addresses is enabled (so, you change the timer to something other than 0), by default only dynamically-learned secure MAC addresses will age out.

[@abdallahelshuraydeh1697]

@@JeremysITLab Thank you! God bless.

[@DandReiOwnU]

I really appreciate your work. Thank you.

[@JeremysITLab]

Thanks, Andrei :)

[@glenntembo2693]

Thanks always J

[@cdialpha]

At, 04:15 we say that we can configure the maximum number of MAC addresses able to be learned by the switch, but do we ever go through the configuration ? presumably something like SW1# port-security max ?

[@DeansLists]

Yea he forgot to add it to this video, but it's in the next lab video

[@Mohamed-mi3iz]

We can do it let's goooooo!!!!!!!!!!!!!!!!!!!

[@nicholassattaur9964]

Thank you Jeremy! Loved the content

[@skynet.yousha]

Thanks again for your explanation. I want to understand, what the use of using mac address aging time feature in port security? Normally a secure Mac-Address learned should remain in the mac-address table but can be changed manually if ever the need be, so that only the desirable device can access the network. What happen if at the time the aging process exhausted(using type absolute), a rogue device is connected on the same port (by unplugging the cable).

[@JeremysITLab]

Security is always a trade-off, making things less convenient to use etc. So aging is just a convenient feature that you can decide to use or not to use, although it is a trade-off for slightly less security.

[@ahmedlateef5244]

Thank you so much, Jeremy.

[@stephenapenkwah]

Thank you Jeremy

[@somaliudiidaceeb2904]

Hi Jeremy thanks again for this great course. I have a question. If i have a Cisco Switch Access-Switch for example C9300L and i configure a port that Lightweight AP will connect to and Wireless-Clients will connect to that AP. If i give IOS command: Config-if#Switchport port-security maximum 1. Will it go to shutdown state? because clients have MAC addresses and AP has MAC. Does switchports learn Wireless clients MAC addresses? Thank you in advance.

[@SULAIMANBOCKRIE]

I'm really enjoying your tutorials. Please make a video for me how to configure a vpn on cisco switch

[@apollosolutions9961]

excellent video bro!

[@JeremysITLab]

Thank you :)

[@carlosenriquelopezperez7269]

Hi Jeremy, I hope you are well, one question, until this class, what topics remain to be seen? Greetings

[@JeremysITLab]

You can check the course progress here: jeremysitlab.com/ccna-course-progress

[@dhanushm.s9608]

Thanks Jeremy ☺️

[@VeryBigBang13]

Thank you

[@ez3871]

Hi Jeremy. Thanks for the best course. Could you please tell me what command you used in minute of 14:16 of this video to see how many seconds are left for "err-disabled" to go away?

[@JeremysITLab]

Thanks for the kind words! The command is shown in that slide ;)

[@mohamedsalah-gk5bn]

thank you , really amazing

[@JeremysITLab]

Thanks :)

[@shashikasamarakoon9990]

Thank you, sir. Got all points

[@majiddehbi9186]

Thx for that Just tell us is there other topic network fundamental 1.1.c all along til 1.1g still to cover sir Just question and as always God bless for all ure help thx again

[@ninosodicho382]

Well explained :)

[@sunburn8863]

hi Jeremy, what about DHCP limit rate can we use it to prevent DHCP exhaustion

[@JeremysITLab]

Yes! I will explain it in the DHCP snooping video.

[@ahtishamsham9230]

Your Vedios are very helpful ❤

[@BR-hp3tm]

.Static mac addresses do not age out but does dynamic secure mac addresses age out ?

[@ifeanyiidika5386]

@JeremysITLab you didn't show how to configure port security to enable an interface accept two or more Secured MAC addresses in a case where PC is connected to an IP phone then to a switch interface. You said something about it but did not show the configuration. Thank you

[@__MisterBee]

Just in case, anyone needs to see this. The interface sub-command is: switchport port-security maximum [number of MAC addresses allowed] You are configuring the total number of MAC addresses allowed on that interface. "Total" meaning: Statically configured + dynamically learned.

[@somethingspecial8163]

Hello sir which concepts are coming under switching ? I hope you will give replay thank you

[@WeBBerTutoriais]

Fantastic! Thanksss!

[@riamu1985]

When u will be finished with full course?? Btw great job u r the best teacher.

[@JeremysITLab]

This year!

[@tomatordia8448]

the best

[@airsofttrooper08]

So one time just for sh*ts and giggles I brought in my lap top to work. I work at one of the top 10 fortune 500 companies (Not going to say which). I figured their security policy would be very explicit. To test it, I changed the mac address and IP address of my personal laptop to reflect that of my work laptop. I plugged the ethernet into my laptop, Then I started a wireshark capture. I had access to all of the companies private data (encrypted of course) that was being broadcast in my subnet. So how would one go about implementing port security in a situation like that? It was quite easy for me to see the traffic and get on to the companies internal (not guest) network from my personal machine?

[@deepbaban6864]

How many videos will it take to complete this course.

[@matsu1994]

The Boson question confuses me.. If the switch does not remove already learned MAC addresses, how does it learn a MAC address? It has already learned the MAC of both PCs.

[@bradward9538]

Got the Boson Exam question wrong at the end. Is there a reason why port security wouldn't drop all packets coming from the Hub, since technically a Hub will have its own MAC address that will be added to the SWA table?

[@nightbat13131]

A hub does not have a mac address. Hubs count as Layer 1 - they are basically fancy wire splitters.

[@trunk2874]

Hi Jeremy, are there hands-on config questions on the ccna 200-301 exam or everything is multiple choice questions?

[@devilsadvocate2163]

Hi! If I'm not mistaken, all the questions are multiple choice :)

[@kamranislamli6748]

Thanks for good job

[@JeremysITLab]

Thank you :)

[@Alien-Networking]

Hi Mr, Jeremy, I tried the lab in GNS3 using vios_l2 switch Version 15.2, and I've noticed that the Security Violation Count doesn't reset unless I go to the interface, disable port security and re-enable it again. I have a physical home lab but being lazy to power up the devices and set up all the cables, 😫 I didn't try it.

[@danycock8493]

hi Jermy can we have automation and wireless please. I appreciate your hard work. but its taking too long to warp up course.can we finish ASAP.

[@danycock8493]

I know appreciate your work.please take your time.I am just addicted to your course.

[@Duck_III]

Thanks Jeremy 🔑

[@LucianC137]

To re enable the interface from err disabled, do we have to do shutdown first then no shutdown, or just no shutdown will work?

[@JeremysITLab]

You have to use 'shutdown' and then 'no shutdown'

[@ss3mania28]

How long more is the course

[@michaelgodwin7702]

Not sure if others ran into this issue, but in packet tracer, it seems that by default my switch shuts down a port whenever I "unplug" it, so I wasn't able to simulate any of this unless I kept the host connected to the switchport and just manually changed it's mac address. Strange, another odd incongruency between my version of packet tracer and yours, it's becoming very common and definitely more than a nuisance at this point.

[@Martin_JY]

Thanks Jeremy!

[@azertytnt421]

Hello , Mr. Please , can you inform me if that all the channel of ccna 200-301 topic are included in exam ccna 200-301 , Because there some topic do not exist in the exam as example DTP , VTP Thank you very much

[@JeremysITLab]

If I include something in the course, I put it there for a reason.

[@eframovavraham9999]

Hi all I don’t get the last question The switch connected to the hub so the first MAC address learned by the switch is the hubs MAC address So the 2 hosts frames need to be dropped ?!? Or hub don’t have MAC address on their interfaces ?

[@nonegiven]

Hubs are layer 1 which means no mac addresses (mac addresses are layer 2). The hub will forward both mac addresses from both PC's but will not have a mac address for itself as it doesn't generate its own traffic.

[@rudy6459]

Thanks for the videos, Jeremy. But why did you snub poopgirl at the end of your video? 🤔

[@JeremysITLab]

Take a guess lol

[@jhde9067]

At 6:48 , the attacker would have to know the addresses that are allowed, no? Edit , it's 6:44 . Talking about an attacker manually configuring the Mac address.

[@JeremysITLab]

Yes, that's correct. For example they could identify the MAC address of the device that is usually connected to the port.

[@ThatOneSix]

Dumb question: default port-security means that only the first MAC plugged in is valid, but what happens if that first device is a switch? Since source/destination MACs change with each hop--and assuming we don't put port-security on this downstream switch--would any device connected to the switch be considered valid? Since, if I'm understanding correctly, PC A, B, and C would all read as the same MAC if filtered through a switch.

[@JeremysITLab]

Switches don’t change the src/dst of frames! They just forward them.

[@ThatOneSix]

@@JeremysITLab Oh, my mistake. So routers change MACs, then?

[@JeremysITLab]

@@ThatOneSix Yep, the router will change the source MAC to that of its own interface, and the destination to the MAC of the next hop router (or the destination host, if it is the last router in the path).

[@ThatOneSix]

@@JeremysITLab Ahhhhh, okay. I had just gotten confused and thought both routers and switches did that. Thank you for clarifying!

[@BR-hp3tm]

would you care to explain please .....12:28 why security violation count should not go higher than 1?

[@JeremysITLab]

Why would it go higher than 1? Check the sentence before that to see why it won't.

[@BR-hp3tm]

@@JeremysITLab thanx for ur time bro......good day.

[@paulschneider2856]

Must keep going

[@mg7670]

Thanks!

[@RnR5]

My head Hurts 🥲

[@Mohamed-mi3iz]

Did you passed?😄

[@aruizsilva]

Thanks!!

[@ConflictEconomics]

I enable port security on a switchport, by simply using " sw port-security" but when I attach a second device to the port it simply learns the new device's mac address and doesn't block the port or go into err-disabled. Anyone know why? I have done absolutely no other configurations to the port in question regarding port security. It is however, sw access vlan 10.

[@1337soundeZ]

Quiz 4 is incorrect - c) Unplugging the unauthorized device will also re enable the interface after 300 seconds like you showed

[@gilmoshe854]

thanks!

[@Alien-Networking]

Images in GNS3 do not work exactly the same as real Cisco devices, I tried the lab today using real Catalyst 3750 and then 2960G with a 2911 router, if you disconnect a cable, the switch will immediatly drain its MAC address table unless you manually configure the interface with [switchport port-security mac address H.H.H or sticky] but in GNS3 it doesnt. Also, the violation counter will reset to 0 only if you shutdown then up the inteface and connect it to the device with autorized MAC and the last source MAC will not disappear, however, in GNS3 if you disable port-security and re-enable it again, everything will reset to 0. these are not major problems in GNS3, but when it comes to spanning-tree it real sucks.

[@susmitamazumder8390]

19:45 min By default, secure mac addresses will NOT 'age out'. then 21:07 min by default only dynamically -learned secure mac addresses will age out. I am confused. there are 3 types of secure mac add: static, sticky and dynamically-learned

[@JeremysITLab]

By default, secure MAC addresses will not age out because the timer is 0. If an aging timer is set, by default only dynamically-learned secure mac addresses will age out.

[@susmitamazumder8390]

@@JeremysITLab thanks

[@JOYASISHMAZUMDER]

is the saying on 20:25 alright ? isnt that contradictary ?

[@JeremysITLab]

Yes, it's correct. The MAC address ages out, but can be re-learned if another frame that MAC address is received - no contradiction.

[@JOYASISHMAZUMDER]

*from that MAC addresss?@@JeremysITLab

[@nedatuaconta2431]

tysm

[@michaelrogers1266]

Port security only worked for me when statically configured, don't you love P.T😂😂😂

[@afkar_zz1680]

Sir when I'm statically configure my pc mac address in switch which is connected to it.. It is not allowing the command. Showing duplicate mac address found... Why is that

[@JeremysITLab]

Did you already configure the same MAC address on a different interface?

[@chrisfoster3772]

why didn't you annouce poopgirl for the jcnp channel members list?

[@manikandanrajkumar6695]

😂

[@majiddehbi9186]

hello just to inform you i couldn't reach the page thx

[@JeremysITLab]

Hi, which page couldn't you reach?

[@majiddehbi9186]

@@JeremysITLab the page about the courses progress

[@JeremysITLab]

@@majiddehbi9186 What is the link address?

[@majiddehbi9186]

@@JeremysITLab links where we could check out the courses progress by the way i send screenshot of the page on ure email

[@pieleanumihai928]

😁

[@hdjr3983]

I think 1 sub would be not enough so I subbed twice for you. 1 of my main account, 1 of my second. Thanks, Sir. Hope you doing well.

[@faizaussi352]

Thank you Jeremy.

[@montassiir]

Thank you

[@RahulSingh-q5t6t]

Thank you Jeremy!!