DEV Community: Muhammad Shahbaz

Lock It Down: How Switch Port Security Keeps Your Network Safe

Muhammad Shahbaz — Sun, 13 Apr 2025 10:30:19 +0000

🔐 What is Switch Port Security?
Switch Port Security is a Layer 2 security feature available on Cisco switches (and other vendors too) that allows you to control access to a switch port based on the MAC address of devices connected to it. It's mainly used to prevent unauthorized devices from accessing the network.

⚙️ How It Works (Functionality):
When port security is enabled on a switch port:

MAC Address Limiting:
You can limit the number of MAC addresses that are allowed on a single port (e.g., only 1 device is allowed).

Sticky MAC Learning:
The switch can automatically learn the MAC address of the connected device and add it to the port security table. These learned MACs can be saved in the running config using the sticky option.

Violation Modes:
If an unauthorized MAC address tries to access the port, the switch takes action based on the violation mode configured:

Protect: Drops packets from unknown MACs but keeps the port up.

Restrict: Same as protect, but also sends an alert and increments a violation counter.

Shutdown (default): Puts the port into error-disabled state (turns it off).

Aging of MACs:
You can configure aging time to remove dynamic MAC addresses after a certain period if they’re no longer active.

lab work

Switch port-security
Switch(config)#int fa0/1
Switch(config-if)#switchport mode acc
Switch(config-if)#swit por?
port-security

Switch(config-if)#swit por
Switch(config-if)#swit port-security ?
aging Port-security aging commands
mac-address Secure mac address
maximum Max secure addresses
violation Security violation mode

Switch(config-if)#swit port-security mac
Switch(config-if)#swit port-security mac-address ?
H.H.H 48 bit mac address
sticky Configure dynamic secure addresses as sticky
Switch(config-if)#swit port-security mac-address sticky ?
H.H.H 48 bit mac address

Switch(config-if)#swit port-security mac-address sticky
Switch(config-if)#swi po
Switch(config-if)#swi port-security ?
aging Port-security aging commands
mac-address Secure mac address
maximum Max secure addresses
violation Security violation mode

Switch(config-if)#swi port-security max ?
<1-132> Maximum addresses
Switch(config-if)#swi port-security max 1?
<1-132>

Switch(config-if)#swi port-security max 1

Switch(config-if)#swi port-security violation ?
protect Security violation protect mode
restrict Security violation restrict mode
shutdown Security violation shutdown mode
Switch(config-if)#swi port-security violation shutdown
Switch(config-if)#exit
Switch(config)#
Switch#
%SYS-5-CONFIG_I: Configured from console by console

show the status of port security before ping the pc
Switch#sh port
Switch#sh port-security int fa0/1
Port Security : Enabled
Port Status : Secure-up
Violation Mode : Shutdown
Aging Time : 0 mins
Aging Type : Absolute
SecureStatic Address Aging : Disabled
Maximum MAC Addresses : 1
Total MAC Addresses : 0
Configured MAC Addresses : 0
Sticky MAC Addresses : 0
Last Source Address:Vlan : 0000.0000.0000:0
Security Violation Count : 0

AFTER PING IT AUTO GAIN THE MAC
Switch#sh port-security int fa0/1
Port Security : Enabled
Port Status : Secure-up
Violation Mode : Shutdown
Aging Time : 0 mins
Aging Type : Absolute
SecureStatic Address Aging : Disabled
Maximum MAC Addresses : 1
Total MAC Addresses : 1
Configured MAC Addresses : 0
Sticky MAC Addresses : 1
Last Source Address:Vlan : 000D.BDC8.51D7:1
Security Violation Count : 0

now connect the unauthorized pc to the switch

you can see the interface is red thats means it administrator down
lets see the switch cli
%LINK-3-UPDOWN: Interface FastEthernet0/1, changed state to down

%LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/1, changed state to down

%LINK-5-CHANGED: Interface FastEthernet0/1, changed state to up

%LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/1, changed state to up

%LINK-5-CHANGED: Interface FastEthernet0/1, changed state to administratively down

%LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/1, changed state to down

Switch#sh port-security int fa0/1
Port Security : Enabled
Port Status : Secure-shutdown
Violation Mode : Shutdown
Aging Time : 0 mins
Aging Type : Absolute
SecureStatic Address Aging : Disabled
Maximum MAC Addresses : 1
Total MAC Addresses : 1
Configured MAC Addresses : 0
Sticky MAC Addresses : 1
Last Source Address:Vlan : 0007.EC3A.B55E:1
Security Violation Count : 1

here you can see the Security Violation Count : 1

🚀 Understanding Channel-Groups in Cisco Switches (EtherChannel with PAgP)

Muhammad Shahbaz — Sat, 05 Apr 2025 19:24:47 +0000

Ever wondered why only one link stays active when connecting two switches with multiple cables? That’s STP (Spanning Tree Protocol) doing its job — blocking redundant paths to prevent loops.

But what if we want to utilize all links for speed and redundancy?

👉 That’s where EtherChannel and channel-groups come into play!

🔹 What is a Channel-Group?
A channel-group is a logical bundling of multiple physical ports into one virtual link using EtherChannel. Instead of blocking ports, STP treats all bundled ports as a single logical connection, allowing all links to stay active.

🔑 Key Benefits:
🚀 Increased bandwidth

🔄 Redundancy

⚡ Faster convergence

✅ Prevents STP from blocking ports

🔧 EtherChannel Basics
Max Ports: 8 per group

Protocols:

PAgP (Cisco proprietary)

LACP (IEEE standard)

🔍 PAgP Configuration Steps

before group-channel one port is block by stp

and

after group-channel all the port ups so its assume switch these are the one port

✅ On Switch 1:

Switch(config)# interface range fa0/1 - 2
Switch(config-if-range)# channel-group 1 mode auto
✅ On Switch 2:

Switch(config)# interface range fa0/1 - 2
Switch(config-if-range)# channel-group 1 mode desirable
📝 auto + desirable creates a successful EtherChannel using PAgP.

🧪 Verification Commands
🔹 Channel-group overview:

Switch# show etherchannel
🔹 Summary of port status:

Switch# show etherchannel summary
You’ll see something like:

Group Port-channel Protocol Ports
1 Po1(SU) PAgP Fa0/1(P) Fa0/2(P)
🔹 Detailed info:

Switch# show interfaces etherchannel
📘 Summary
Before EtherChannel:
➡ STP blocks one of the redundant ports to avoid loops.

After EtherChannel:
✅ All ports bundled together, treated as one logical link, so no port is blocked by STP!

This is one of the smartest ways to scale bandwidth and boost performance between switches.

Cisco #EtherChannel #Networking #CCNA #Switching #PAgP #NetworkEngineer #TechTips #ChannelGroup #LACP

🔒 Securing Network Access with SSH on Cisco Switches! and lab work

Muhammad Shahbaz — Fri, 04 Apr 2025 17:26:36 +0000

Today, I successfully configured SSH (Secure Shell) on a Cisco 2960 switch in Packet Tracer to enable encrypted remote access! Unlike Telnet, which transmits data in plain text, SSH ensures end-to-end encryption, making it the preferred choice for network security.

Switch> enable
Switch# configure terminal

Set the hostname

Switch(config)# hostname S1

Configure the domain name (needed for RSA key generation)

Switch1(config)# ip domain-name shahbaz.com

Generate RSA keys (1024-bit or higher for security)

Switch1(config)# crypto key generate rsa

Choose 1024 bits or more when prompted.

Create a local user with a strong password

Switch1(config)# username awan privilege 15 secret StrongPass123

Enable SSH version 2 for better security

Switch1(config)# ip ssh version 2

Assign an IP address to VLAN 1 for remote access

Switch1(config)# interface vlan 1
Switch1(config-if)# ip address 192.168.1.2 255.255.255.0
Switch1(config-if)# no shutdown
Switch1(config-if)# exit

Enable SSH access on Virtual Terminal (VTY) lines

Switch1(config)# line vty 0 4
Switch1(config-line)# login local # Use local authentication
Switch1(config-line)# transport input ssh # Allow only SSH
Switch1(config-line)# exit

Save configuration

Switch1# wr

This configuration enables SSH access, setting up local authentication and encrypting remote login sessions.
💡 How to Access the Switch via SSH from a PC?
On a Windows/Linux/Mac system, open a terminal or Command Prompt and use:
ssh -l awan 192.168.1.2
enter password StrongPass123
now you successfully configure the and access the ssh
💡 Pro Tip: Always use SSH over Telnet for securing your network infrastructure! Network security is critical, and encrypted communication helps prevent cyber threats like MITM (Man-in-the-Middle) attacks.

and the telnet configuration and lab are

🚀 Mastering Remote Switch Access with Telnet in Cisco Networking! 🔥
Today, I successfully set up Telnet remote access across multiple Cisco 2960 switches in Packet Tracer. This setup allows me to manage all switches from a single PC (PC2) without direct console access!
💡 Key Takeaways from this Lab:
✅ Configured VLAN 1 with unique IP addresses
✅ Enabled Telnet for remote switch management
✅ Verified connectivity with ping & telnet commands
🔍 What is Telnet?
Telnet (short for Telecommunication Network) is a remote access protocol that allows users to connect to network devices (like routers, switches, and servers) using a command-line interface. It operates on port 23 and is often used for device management in networking.
🌟 Key Features of Telnet
✅ Allows remote access to network devices
✅ Uses a virtual terminal for command execution
✅ Works over TCP/IP networks
✅ Used in Cisco devices for switch/router configuration
⚠️ Security Concern
🔴 Telnet transmits data in plain text (including passwords), making it insecure for modern networks.

lab work of telnet i take 4 switches and one pc with connect the console cable to gain the ramotely access
📡 Telnet Configuration for Your Packet Tracer Topology

🛠 Step 1: Assign IP Addresses to Switches
Since switches don’t have Layer 3 interfaces, we will assign VLAN 1 IP addresses for remote access.i used class c ip scheme
IP Addressing Scheme
Device and VLAN 1 IPs
S1=192.168.1.1,
S2=192.168.1.2,
S3=192.168.1.3,
S4=192.168.1.4,
PC2=192.168.1.100

🖥 Step 2: Configure Each Switch for Telnet

Apply this configuration on all switches (S1 to S4).
🔹 Replace the IP address with the one assigned to each switch.
📌 Example Config for S1 (Modify IP for S2, S3, S4)

enable
hashtag#configure terminal

hashtag#hostname S1

interface vlan 1
ip address 192.168.1.1 255.255.255.0
no shutdown
exit
line vty 0 4
password 1234
login
transport input telnet
exit

enable secret 1234
end
write memory

same configure all the switches jutt replace the ip address and for better performance run the trunk mode all the connected interfaces

🖥 Step 3: Configure PC2
Go to Desktop → IP Configuration
IP Address: 192.168.1.100
Subnet Mask: 255.255.255.0

🚀 Step 4: Access Switches from PC2
Open PC2’s Command Prompt
Telnet to any switch (e.g., S1):
and ping 192.168.1.1 after successfully ping then use telnet to access remotely using telnet...
telnet 192.168.1.1
enter password 1234
You're now remotely connected! 🎉,
we also create the users and manage the limilt of user maximum 16 user like 0 to 15

Building a Multi-Switch VLAN Network: A Successful Implementation

Muhammad Shahbaz — Sun, 23 Mar 2025 22:19:08 +0000

Introduction
In modern networking, Virtual LANs (VLANs) play a crucial role in segmenting networks for improved security, efficiency, and manageability. Recently, I built a multi-switch VLAN network in Cisco Packet Tracer, connecting different departments while ensuring seamless communication within VLANs. In this article, I'll walk you through the setup, configuration, and successful implementation of VLANs and trunking across multiple switches.

Network Design Overview
In my network topology, I designed a three-switch network that connects multiple departments:
** Finance Department (VLAN 2)**
Devices with IP range 192.168.1.2 - 192.168.1.4
Call Center (VLAN 3) -
Devices with IP range 192.168.1.5 - 192.168.1.8
** HR Department (VLAN 2) -**
Devices with IP range 192.168.1.9 - 192.168.1.10

Each department's devices are connected to their respective access ports on the switches. To ensure inter-switch communication, I configured trunk ports between switches.

Step-by-Step Configuration
1️⃣ Creating VLANs on Each Switch
Each switch was configured with the necessary VLANs. I used the following commands:

Switch(config)# vlan 2
Switch(config-vlan)# name Finance
Switch(config-vlan)# exit

Switch(config)# vlan 3
Switch(config-vlan)# name Call_Center
Switch(config-vlan)# exit
Assigning VLANs to Access Ports
After creating VLANs, I assigned specific ports to each VLAN:

Switch(config)# interface FastEthernet 0/1
Switch(config-if)# switchport mode access
Switch(config-if)# switchport access vlan 2
Switch(config-if)# exit
Similarly, I assigned VLAN 3 to the respective ports.

Configuring Trunk Ports Between Switches
To allow VLAN traffic between switches, I set up trunk links on interconnecting ports:

Switch(config)# interface FastEthernet 0/3
Switch(config-if)# switchport mode trunk
Switch(config-if)# switchport trunk allowed vlan 2,3
Switch(config-if)# exit
Testing and Results
Once the VLANs and trunks were configured, I tested connectivity using the ping command.

Devices within VLAN 2 could successfully communicate with each other.
Devices within VLAN 3 were able to exchange data seamlessly.
Trunk ports functioned correctly, ensuring VLAN communication across switches.

Conclusion
This project was a great hands-on experience in configuring VLANs and implementing inter-switch trunking. Proper VLAN segmentation enhances network performance by reducing broadcast domains and improving security.

By successfully configuring VLANs and trunks, I was able to establish efficient communication between departments while keeping the network properly structured.

💡 Are you working on VLAN configurations? Let’s connect and discuss! 🚀

Comprehensive Guide to AWS VPC Peering: Configuring Multi-Region Connectivity

Muhammad Shahbaz — Wed, 14 Aug 2024 12:42:28 +0000

cloud network architecture with two regions: Region-1 and Region-2. In each region, there are two VPCs (Virtual Private Clouds) connected via an intra-region VPC peering connection. Additionally, each VPC in Region-1 is connected to VPC 3 in Region-2 using inter-region VPC peering connections. This setup allows for communication and resource sharing between VPCs within the same region and across different regions.
so we are going to implement this in the aws.so lets get start

Step 1: Create Two VPCs in N. Virginia Region
Login to AWS Management Console:

Navigate to the VPC Dashboard.
Create the First VPC:

VPC Name: VPC-A
CIDR Block: 10.0.0.0/16
Tenancy: Default (or Dedicated if required)
Create the Second VPC:

VPC Name: VPC-B
CIDR Block: 10.1.0.0/16
Tenancy: Default

Step 2: Create Subnets in Each VPC
For VPC-A:

Subnet 1 (AZ1):
Name: Subnet-A1
Availability Zone: us-east-1a (N. Virginia)
CIDR Block: 10.0.1.0/24

For VPC-B:

Subnet 1 (AZ1):
Name: Subnet-B1
Availability Zone: us-east-1a
CIDR Block: 10.1.1.0/24

Step 3: Create Internet Gateways and Route Tables for Each VPC
Create an Internet Gateway (IGW) for VPC-A:

Name: IGW-A
Attach it to VPC-A.
Create an Internet Gateway (IGW) for VPC-B:

Name: IGW-B
Attach it to VPC-B.
Update Route Tables:

For VPC-A:
Public Route Table: Create a route to 0.0.0.0/0 pointing to IGW-A.
Associate it with Subnet-vpcA
For VPC-B:
Public Route Table: Create a route to 0.0.0.0/0 pointing to IGW-B.
Associate it with Subnet-VpcB

Step 4: Launch EC2 Instances in N. Virginia
Instance in VPC-A:

Name: Instance-vpcA
Subnet: Subnet-vpcA
Availability Zone: us-east-1a
Security Group: Create a security group allowing SSH (port 22) and ICMP (for ping).
Instance in VPC-B:

Name: Instance-vpcB
Subnet: Subnet-vpcB
Availability Zone: us-east-1b
Security Group: Create a security group allowing SSH (port 22) and ICMP (for ping).

another

instance name vpcB

Step 5: Create VPC Peering Between VPC-A and VPC-B in N. Virginia
Initiate VPC Peering Request:
search vpc
Go to the VPC Peering section.
Source VPC: VPC-A
Destination VPC: VPC-B
Accept the request from VPC-B.
Update Route Tables:

For VPC-A:
Update the route table associated with VPC-A to route traffic for 10.1.0.0/16 through the VPC Peering connection.
For VPC-B:
Update the route table associated with VPC-B to route traffic for 10.0.0.0/16 through the VPC Peering connection.

Step 6: Launch an EC2 Instance in Ohio Region
Create a VPC in Ohio:

VPC Name: VPC-C
CIDR Block: 10.2.0.0/16
Create subnets, an internet gateway, and route tables as needed.
Launch EC2 Instance in Ohio:

Name: Instance-vpcC
Subnet: Choose any subnet created in VPC-C.
Security Group: Create a security group allowing SSH (port 22) and ICMP (for ping)

Step 7: Establish VPC Peering Between VPC-C (Ohio) and VPCs in N. Virginia
Create VPC Peering Between VPC-A and VPC-C:

Initiate a peering request from VPC-A to VPC-C in the Ohio region.
Accept the request from VPC-C.
Create VPC Peering Between VPC-B and VPC-C:

Initiate a peering request from VPC-B to VPC-C in the Ohio region.
Accept the request from VPC-C.

accept from other region

so we have completed all the lab its time to check the connect
just open the ssh and pings private ips

its not ping each other because of we did not add route peering connect just follow these steps more
Update Route Tables:

For VPC-A:
Route traffic for 10.2.0.0/16 through the peering connection.
For VPC-B:
Route traffic for 10.2.0.0/16 through the peering connection.
For VPC-C:
Route traffic for 10.0.0.0/16 and 10.1.0.0/16 through the respective peering connections.

now its time to testing
Step 8: Testing Connectivity
SSH into Instance-vpcA (N. Virginia):

Attempt to ping and SSH into Instance-vpcA and Instance-vpcC ohio region.

SSH into Instance-vpcB (N. Virginia):

Attempt to ping and SSH into Instance-vpcC and Instance-vpcB.

Attempt to ping and SSH into Instance-VpcA and Instance-VpcB.

If all configurations are correct, the instances should be able to communicate across VPCs and regions.

"How to Launch a Website on AWS: Configuring a VPC and EC2 Instance"

Muhammad Shahbaz — Sun, 11 Aug 2024 13:20:16 +0000

Create a VPC Go to the VPC Dashboard in the AWS Management Console. Click on Create VPC.

Choose VPC only.
Provide a Name and CIDR Block (e.g., 10.0.0.0/26).

Select Tenancy as default.
Click on Create VPC.

Create Subnet After creating the VPC, navigate to Subnets. Click on Create Subnet.

Select the VPC you just created.
Provide a Name and CIDR Block (e.g., 10.0.1.0/24).
Specify the Availability Zone.
Click on Create Subnet.

subnet successfully created

Create and Attach an Internet Gateway Go to Internet Gateways. Click on Create Internet Gateway. Provide a Name.

After creation, Attach the Internet Gateway to your VPC

Update Route Table create Route Tables.

Select the route table associated with your VPC.
Add a new route:
Destination: 0.0.0.0/0
Target: The Internet Gateway you just attached.
Save the route.

Launch an EC2 Instance Go to the EC2 Dashboard. Click on Launch Instance. Select Amazon Linux 2023 as the OS. Choose the instance type (e.g., t2.micro). In Network Settings: Select the VPC and Subnet you created earlier. Enable Auto-assign Public IP.

Configure Security Group In the same wizard, under Security Group, create a new security group. Add the following rules: HTTP: Port 80, Source 0.0.0.0/0.

Review and launch the instance.

Add User Data Script Under the Advanced Details section, add the following script in the User Data field: bash Copy code #!/bin/bash yum update -y yum install -y httpd systemctl start httpd systemctl enable httpd echo "
Welcome to My Website!
" > /var/www/html/index.html This script installs Apache, starts the web server, and creates a simple HTML file.

Launch and Access the Website Complete the wizard and launch the instance. Once the instance is running, obtain its Public IP from the EC2 Dashboard. Open a web browser and enter the Public IP (e.g., http://). You should see the message "Welcome to My Website!"

there is no load of website because its run upon https just remove s from https

access fully hosting the website

Optimizing AWS EBS Volumes and Snapshots: Detailed Instructions and Best Practices

Muhammad Shahbaz — Wed, 07 Aug 2024 11:06:06 +0000

launch the instance
select the window os
create private key
add one additional volume 10 gb

go to ebs volume and see the two volumes one is root volume and other one is disk d volume.

go to the instances and select the instance
connect the instance open RDP
download the disktop remote in the device
enter the password which copy from the RDP by uploading the private key and generate the password

the virtual remote disktop is open

go to the disk management there are two volume which are created at the time of launch instance
configure the disk1 and online disk and configure it
in disk d an text file created and add the text and save it

its text saved file

the two volumes root and the disk d
go to aws
in EBS volume select the volume the click on action

create the snapshot

go to snapshot section you can access the snapshot
now delete the disk d volume

from remote disktop its also vanished/deleted

select the snapshot and click on action

click on create volume from snapshot

here you can increase the size of snapshot(backup) volume but can't be decrease of the original snapshot size
click on create

here the volume is created from the snapshot its size is 11gb and the old disk d was 10gb

the time is to attach this volume to the instance you want but the AZ should be same both of instance and volume

here there are disk d previous configure disk and 1 gb extra now we configure it and name it disk e

from disk d the file is successfully restore

also the text we added its save

go to aws snapshots section
click on recycle bin

create retention rule
give name

apply all and enter the days that how many days an snapshot should be in recycle bin and its auto delete after that

there are two option lock which means recycle bin locked only root user access it
and other one is unlock means other user also can access recycle bin
click on create retention rule

select the snapshot and delete it

there are no snapshots

but its also in recycle bin and we can restore it very easily

snapshots successfully restored

Maximizing Your AWS EC2 Instance Storage: A Step-by-Step Guide

Muhammad Shahbaz — Tue, 06 Aug 2024 10:25:43 +0000

Step 1:

Create a Windows EC2 Instance Launch an EC2 Instance:
Go to the AWS Management Console.
Navigate to the EC2 dashboard.
Click on "Launch Instance".
Select the Windows Server of your choice.
Choose an instance type that meets your requirements.
Configure instance details as needed.
In the "Add Storage" section, specify an initial root volume size (e.g., 30 GB).

Generate a Private Key:

During the setup, create a new key pair or use an existing one.
Download the private key file (.pem) and store it securely.
the .pem we use for the window here
first enter the name of the key then save it to the device. for later use at this point all the other setting is on default form
just launch the instance.
Wait for the instance to reach the "running" state.

In the EC2 dashboard, navigate to "Volumes" under "Elastic Block Store".
click on create volume then choose volume type and choose storage how many you need after that create volume
remember create volume as the same availability zone in which you have instance

after complete the creation volume step the next step is to attach volume
firstly select your volume which you created then goto actions
open the attach volume option

select the instance it automatic show you all the instance you have in this region
then select the device then attach the volume
if the instance not shown then you created the volume another availability zone.
the volume and the instance must be in same AZ then they attached
after completing the attach volume go to instance section

in this section select the instance then click on the connect button its show three option
then go to RDP section

this section is to create the remote desktop to access the server so firstly download the remote desktop in your device
then open it.
when the password screen occure then go to aws RDP section click on the generate password option

there upload the private key which you have download at the time of instance launching to your device
after that click on the encrypt password

then copy the password

paste the password

the virtual remote desktop show on the screen to see how many storage it have go to this pc section

here its only the root volume the other volume 10gb which we created don't show
so go to disk management its show root volume and other volume but the other volume which we have create is not configure that's why its not show on the pc section

firstly we sectlect the volume then right click on it select online option then its turn red to blue its means its online.
then some partitions there on the clicking the where storage show then created new disk d and confirm it.

the pc selection its show two disks one is root and the other one is disk d which we attach successfully after launching the instance