SPAN/USPAN/ERSPAN , 802.1x, Radius

Switch port analyzer

 

Wireshark 로 하던 cable to cable packet capture를 (Client to server or vise versa)  Protocol을 이용해서 포트에 걸어가지고, 우리 랩탑에서 스위치 그 포트에 꽂았을때 패킷 캡쳐 할수잇또록 하는 기술 This why this protocol called switch port analyzer

 

Switch - Client == SPAN

Switch - Switch == RSPAN

Switch - Router - Switch == ERSPAN

 

 

SPAN also referred to as port mirroring

Packet copies are sent to a traffic analyzer (wireshark or other traffic analyzing tool)

Analyzers aggregate and sort data in a visual manner

 

 

Local SPAN : Traffic captured and mirrored locally

Remote SPAN (RSPAN) : Monitor multiple remote switches, traffic copied to a central traffic analyzer

Encapsulated Remote SPAN (ERSPAN) : Cisco proprietary version, Uses generic routing encapsulation (GRE)

• For implement, we don't need to create GRE session and etc… just set the ip address and other configuration on the switch -> cisco minimized the configuration as much as they can

 

Creating monitoring session, and send the data (work method)

Destination is the some special VLAN we have to create

 

 

 

 

802.1X

 

As known as port authentication

 

Public switch -> Internet (block in the middle)

 

Switch act as proxy of the authentication server (AS, Authentication Server)

 

 

Through the virtual port

Once the user is authroized, virtual port will be change to actual port

 

Public wifi use website 같은.. Etc, once this solution is deployed, user have to put their credential to sign in, and

 

 

RADIUS

 

AAA framework and RADIUS

 

AAA

Authentication - who are you?

Verifying the account

 

Authorization - what can you do?

Privileges

 

Accounting - What did you do?

Log tracking, data collection

 

 

Network access server (remote access server)

 

 

WAP (Wireless access point), in this case it will be RADIUS Client

 

1. Authentication request
2. Authentication Request
3. Compares with user database
4. Authentication acknowledgement
5. Records in accounting database
6. Approval to laptop

 

 

 

Port-security

 

MAC주소의 수를 제한하여 허가된 MAC 만 접속하도록 하는 것

 

통신을 허용할 장비의 Mac주소 등록가능 또는, Maximum MAC leaning count limitation 줄 수 도있음