cisco certification on security

cisco certification on security.Figure 4-16 The process of exchanging Diameter protocol messages between Diameter peers when providing authentication services for network access with Diameter4.10.2 Port-Based Access ControlPort-based access control is associated with a specific access port (e.g., a port on an access layer switch). The idea behind this access control implementation is to allow or deny access to specific resources to devices that are physically connected to a particular network port. This section discusses two port-based access control implementations supported by Cisco devices: port security and 802.1Xo Both access control implementations are based on the ABAC model (sometimes referred to as the identity-based or rule-based access control model).Port security Port security is a security feature supported by most Cisco routers and switches that enables access control by strictly restricting the MAC (medium access control) addresses of devices connected to a specific (router or switch) port. Unlike MAC access control lists, port security "manages" only the source MAC address and does not match the destination MAC address.Tip: Please do not confuse the Medium Access Control (MAC) address with the Mandatory Access Control (MAC) model. The former refers to the address of the Ethernet card, and the latter refers to an access control model.Port security works by first creating a pool of MAC addresses on a network device, and only devices that have MAC addresses in that pool can transmit data through a given port on that network device. MAC address pools can be created in two ways: statically defined and dynamically learned. As opposed to needing to apply and define MACs on a per-port, per-entry basis4.10 Implementation of Identity and Access Control Mechanisms 209MAC access control list of address records (table entries), the dynamic learning approach can significantly reduce the administrative cost of implementing port access control. When a switch receives a data frame from a port, its port security function checks the source MAC address of the frame. If the MAC address matches a MAC address in the MAC address pool, the switch forwards the frame; otherwise, it discards the frame. In addition to the ability to drop frames from unauthorized MAC addresses, the port security feature can also perform port security violation control. The following are two examples of port security violations.A switch with port security enabled and port-restricted access to a specific MAC address learns the same restricted MAC address from two different ports belonging to the same VLAN. This port security violation is called a MAC address shift (MAC move). oWhen the number of MAC addresses learned by a switch port reaches the allowed limit, the port learns a new MAC address through a received data frame.