zNetLaB › Guided labs › Security
Switch hardening 57 — park and shut the unused ports
Security Intermediate 3 devices 5 checked tasks 100 points Plan lab
Scenario — the audit of Nellore found open wall ports with live access ports behind them. Only Fa0/1 (VLAN 26) is in use. Create a parking VLAN 956 named PARKED, move every other access port Fa0/2 – Fa0/6 into it, and shut them down; keep Fa0/1 working with port security limited to one address. You build it in a browser, type real commands at each device, and every task below is
checked against the running configuration — so you find out it is wrong before anybody else does.
Open this lab in the simulator
The simulator runs in your browser with nothing to install. This lab is part of the full simulator: open it free for 7 days with a new account, then with a plan. It needs an account, which keeps your progress.
The scenario
the audit of Nellore found open wall ports with live access ports behind them. Only Fa0/1 (VLAN 26) is in use. Create a parking VLAN 956 named PARKED, move every other access port Fa0/2 – Fa0/6 into it, and shut them down; keep Fa0/1 working with port security limited to one address.
Your role: a security engineer. Level: Intermediate Done when: all 5 goals show as passed (100 points).
Network status
Devices: 1 switch, 2 PCs, cabled as drawn. No Layer 1 or Layer 2 faults: every link is connected and up. SW-Nellore starts with and VLAN 26 already configured. Faculty-PC is a host with 10.76.0.11/24. Server is a host with 10.76.0.12/24. Known problems
None: nothing is misconfigured. The network is simply not finished: what the goals list is what you have to build or secure. Goals
VLAN 956 exists and is named PARKED (15 pts) Fa0/2 – Fa0/6 are access ports in VLAN 956 (25 pts) Fa0/2 – Fa0/6 are shut down (25 pts) Fa0/1 allows one MAC address (20 pts) The PC still reaches the server (15 pts) The activity, in order
VLAN 956 exists and is named PARKED Why: A port assigned to a VLAN that does not exist carries nothing. Verify with: show vlan brief Fa0/2 – Fa0/6 are access ports in VLAN 956 Why: A VLAN is a separate broadcast domain; the port’s VLAN decides which devices can talk without a router. Verify with: show vlan brief Fa0/2 – Fa0/6 are shut down Why: This is the task that checks your configuration directly: the line must really be there, not just look right. Verify with: show running-config Fa0/1 allows one MAC address Why: Port security stops somebody plugging an extra switch or laptop into a wall port. Verify with: show port-security The PC still reaches the server Why: A ping needs a route in BOTH directions. This is the end-to-end proof that everything before it worked. Verify with: ping 10.76.0.12 Tips
Work in the order given: later goals depend on the earlier ones. After every change, run the verify command before moving on; do not guess. Stuck? Read the verify output first. It names the interface, neighbour or route that is wrong. Common mistake: Shutting the port but leaving it in a production VLAN Common mistake: Parking the port in VLAN 1 Common mistake: Moving a port that is in use Why this matters
An unused port is an open door: anyone can plug in and land on a production VLAN. The hardening checklist is the same everywhere — move unused ports to a dead-end VLAN and shut them — and it is the first thing a security audit looks for.
What you will be able to do
Create a parking VLAN
Shut and move unused access ports
Keep working ports intact
The network
Catalyst 2960-24TT, PC — 3 devices in all, already cabled.
Fa0/1 Fa0 Fa0/7 Fa0 SW-Nellore Faculty-PC 10.76.0.11/24 Server 10.76.0.12/24 Drawn from this lab: devices, cables, ports and the addresses already set. Device Model Address already set
SW-Nellore Catalyst 2960-24TT configure it Faculty-PC PC 10.76.0.11 / 255.255.255.0 Server PC 10.76.0.12 / 255.255.255.0
Cabling
SW-Nellore Fa0/1 ↔ Faculty-PC Fa0 SW-Nellore Fa0/7 ↔ Server Fa0
What is configured at the start
These are already configured when the lab opens — including, where this is a troubleshooting lab, the fault itself:
SW-Nellore vlan 26
exit
interface fa0/1
switchport mode access
switchport access vlan 26
exit
interface fa0/7
switchport mode access
switchport access vlan 26
exit Tasks, and how each one is checked
Every task is decided by reading the live network — a neighbour in FULL, a ping that succeeds, a line in the running configuration — not by looking for a keyword you typed. The same command shows you what the lab sees.
# Task Pts How to verify it yourself
1 VLAN 956 exists and is named PARKED 15 On SW-Nellore: show vlan brief lists VLAN 956. and On SW-Nellore: show running-config contains the line(s) matching vlan 956 … name PARKED. 2 Fa0/2 – Fa0/6 are access ports in VLAN 956 25 On SW-Nellore: show vlan brief — Fa0/2 is an access port in VLAN 956. and On SW-Nellore: show vlan brief — Fa0/3 is an access port in VLAN 956. and On SW-Nellore: show vlan brief — Fa0/4 is an access port in VLAN 956. and On SW-Nellore: show vlan brief — Fa0/5 is an access port in VLAN 956. and On SW-Nellore: show vlan brief — Fa0/6 is an access port in VLAN 956. 3 Fa0/2 – Fa0/6 are shut down 25 On SW-Nellore: show running-config contains the line(s) matching interface FastEthernet0/2 … shutdown. and On SW-Nellore: show running-config contains the line(s) matching interface FastEthernet0/3 … shutdown. and On SW-Nellore: show running-config contains the line(s) matching interface FastEthernet0/4 … shutdown. and On SW-Nellore: show running-config contains the line(s) matching interface FastEthernet0/5 … shutdown. and On SW-Nellore: show running-config contains the line(s) matching interface FastEthernet0/6 … shutdown. 4 Fa0/1 allows one MAC address 20 On SW-Nellore: show port-security interface Fa0/1 — maximum 1. 5 The PC still reaches the server 15 On Faculty-PC: ping 10.76.0.12 must succeed.
Stuck? Ask the coach
Tell the coach what you see or what you tried. It gives you a hint, not the answer, the way a senior engineer would. Included with a free trial or any plan.
Ask the coach
Common mistakes
Shutting the port but leaving it in a production VLAN
Parking the port in VLAN 1
Moving a port that is in use
Reference solution
Try it yourself first — the lab checks your work either way. This is one configuration that makes every task pass, device by device:
SW-Nellore vlan 956
name PARKED
exit
interface range fa0/2 - 6
switchport mode access
switchport access vlan 956
shutdown
exit
interface fa0/1
switchport port-security
switchport port-security maximum 1
exit Where this is examined
CCNA 5.0 device security; Security+ 3.2; CCNP ENCOR.
This lab practises these topics in the zNetLaB certification courses:
Port security, DHCP snooping, DAI — CCNA · Security Fundamentals ACLs, ZBFW, 802.1X, MACsec, wireless security — CCNP Enterprise · ENCOR · Security Access control: ACLs, AAA, remote access and VPNs — CompTIA Network+ · Network Security Network segmentation, DMZ and firewalls — CompTIA Security+ · Security Architecture Layer-2 attacks: MAC flooding, VLAN hopping, STP takeover — Ethical Hacking (network level) · Network Attacks and Defences Port security — Switching and VLAN Mastery · Securing the access layer
Related labs
Where to start
The lessons all guided labs plans
CCNA®, CCNP® and Cisco® are trademarks of Cisco Systems, Inc. zNetLaB is not affiliated with or endorsed by Cisco.