Temukan Panduan

» » »

Port Security & Monitoring: Panduan untuk Mengamankan Jaringan

Port security dan monitoring adalah komponen kritis dalam mengamankan infrastruktur jaringan dari berbagai ancaman. Artikel ini akan membahas teknik-teknik untuk mengamankan port jaringan dan memonitor aktivitas yang mencurigakan.

Apa Itu Port Security?

Port Security adalah serangkaian teknik dan konfigurasi yang dirancang untuk mengontrol akses ke port switch berdasarkan MAC address perangkat yang terhubung. Tujuannya adalah mencegah unauthorized access, spoofing, dan berbagai serukan Layer 2.

Mengapa Port Security Penting?

  1. Mencegah Rogue Devices: Device tidak dikenal yang terhubung ke jaringan
  2. Mitigasi MAC Flooding: Serukan yang mengisi MAC address table
  3. Network Access Control: Hanya perangkat terotorisasi yang bisa akses
  4. Compliance: Memenuhi standar keamanan industri

Teknik Port Security Dasar

Teknik Deskripsi Implementasi Level Proteksi
MAC Address Limiting Membatasi jumlah MAC address per port Switch Configuration Dasar
Static MAC Binding Mengikat MAC address tertentu ke port tertentu Switch Configuration Menengah
Sticky MAC Learning Switch belajar MAC address lalu membuat static entry Switch Configuration Menengah
Port Security dengan Aging MAC address dihapus setelah periode tertentu Switch Configuration Menengah
802.1X Authentication Authentication berbasis port dengan RADIUS Switch + RADIUS Server Tinggi

Konfigurasi Port Security di MikroTik

1. MAC Address Limiting

Via Winbox:

  1. Buka menu Bridge
  2. Pilih tab Filters
  3. Klik + (Add New)
  4. Chain: forward
  5. Src. MAC Address: 00:00:00:00:00:00/00:00:00:00:00:00
  6. Src. MAC Address Mask: 00:00:00:00:00:00
  7. Limit: 3,5 (3 packets, 5 per time)
  8. Action: drop
  9. Apply → OK

Via CLI:

 # Limit 3 MAC addresses per port [admin@MikroTik] > interface bridge filter add chain=forward src-mac-address=00:00:00:00:00:00/00:00:00:00:00:00 src-mac-address-mask=00:00:00:00:00:00 limit=3,5 action=drop
# Limit berdasarkan port tertentu
[admin@MikroTik] > interface bridge filter add chain=forward in-interface=ether2 src-mac-address=00:00:00:00:00:00/00:00:00:00:00:00 limit=2,1m action=drop

2. Static MAC Binding

 # Tambahkan static MAC address entry [admin@MikroTik] > interface bridge host add bridge=bridge-local interface=ether2 mac-address=AA:BB:CC:DD:EE:FF
# Atau melalui bridge filter
[admin@MikroTik] > interface bridge filter add chain=forward src-mac-address=!AA:BB:CC:DD:EE:FF in-interface=ether2 action=drop

# Multiple MAC addresses pada satu port
[admin@MikroTik] > interface bridge filter add chain=forward in-interface=ether2 src-mac-address=AA:BB:CC:DD:EE:FF action=accept
[admin@MikroTik] > interface bridge filter add chain=forward in-interface=ether2 src-mac-address=11:22:33:44:55:66 action=accept
[admin@MikroTik] > interface bridge filter add chain=forward in-interface=ether2 action=drop

3. Port Isolation dengan Horizon

Port Horizon membatasi komunikasi antara port dalam bridge yang sama. Port dengan horizon value sama tidak bisa berkomunikasi.

 # Isolasi port agar tidak saling komunikasi [admin@MikroTik] > interface bridge port set [find interface=ether2] horizon=1 [admin@MikroTik] > interface bridge port set [find interface=ether3] horizon=2 [admin@MikroTik] > interface bridge port set [find interface=ether4] horizon=1 # Hasil: ether2 dan ether4 tidak bisa komunikasi (sama-sama horizon=1) # ether3 bisa komunikasi dengan semua (horizon berbeda)

Monitoring dan Logging

1. Setup Syslog Server

 # Kirim log ke syslog server eksternal [admin@MikroTik] > /system logging action add name=remote-syslog target=remote remote=192.168.1.100:514 [admin@MikroTik] > /system logging add topics=info,warning,error action=remote-syslog
# Log untuk security events
[admin@MikroTik] > /system logging add topics=firewall action=remote-syslog
[admin@MikroTik] > /system logging add topics=system,info action=remote-syslog

2. Traffic Monitoring dengan Torch

Torch adalah tool real-time traffic monitoring di MikroTik yang menunjukkan traffic per connection.

 # Monitor traffic pada interface tertentu [admin@MikroTik] > /tool torch interface=ether2 src-address=0.0.0.0/0 dst-address=0.0.0.0/0 port=any # Monitor dengan filter tertentu [admin@MikroTik] > /tool torch interface=all src-address=192.168.1.100 dst-port=80,443 protocol=tcp # Via Winbox: Tools → Torch → Select interface → Start

3. Packet Sniffer

 # Capture packets ke file [admin@MikroTik] > /tool sniffer quick interface=ether2 file-name=capture.pcap
# Capture dengan filter
[admin@MikroTik] > /tool sniffer quick interface=ether2 src-address=192.168.1.0/24 dst-port=22 protocol=tcp

# Capture hanya headers (tanpa data)
[admin@MikroTik] > /tool sniffer set streaming-enabled=no
[admin@MikroTik] > /tool sniffer quick interface=ether2 streaming-enabled=no

Advanced Port Security Techniques

1. DHCP Snooping

DHCP Snooping mencegah rogue DHCP servers dan DHCP starvation attacks.

 # Enable DHCP snooping pada bridge [admin@MikroTik] > /interface bridge set bridge-local dhcp-snooping=yes # Tentukan trusted ports (ports menuju legitimate DHCP server) [admin@MikroTik] > /interface bridge port set [find interface=ether1] trusted=yes # Tampilkan DHCP binding table [admin@MikroTik] > /interface bridge host print where dhcp=yes # Blokir DHCP packets dari untrusted ports [admin@MikroTik] > /interface bridge filter add chain=forward in-interface=ether2 protocol=udp src-port=67-68 action=drop

2. Dynamic ARP Inspection (DAI)

DAI mencegah ARP spoofing attacks dengan memvalidasi ARP packets terhadap DHCP snooping database.

 # Enable ARP inspection [admin@MikroTik] > /interface bridge set bridge-local arp=enabled # Filter ARP packets yang mencurigakan [admin@MikroTik] > /interface bridge filter add chain=forward protocol=arp action=drop [admin@MikroTik] > /interface bridge filter add chain=forward protocol=arp arp-opcode=request in-interface=ether2 action=accept [admin@MikroTik] > /interface bridge filter add chain=forward protocol=arp arp-opcode=reply in-interface=ether1 action=accept

3. IP Source Guard

 # Filter berdasarkan IP source address [admin@MikroTik] > /interface bridge filter add chain=forward src-address=!192.168.1.100 in-interface=ether2 action=drop
# Kombinasi dengan DHCP binding
[admin@MikroTik] > /interface bridge filter add chain=forward in-interface=ether2 src-address=192.168.1.0/24 action=accept
[admin@MikroTik] > /interface bridge filter add chain=forward in-interface=ether2 action=drop

Network Monitoring Tools

1. The Dude

The Dude adalah network monitoring tool dari MikroTik untuk memonitor seluruh infrastruktur jaringan.

 # Install The Dude package [admin@MikroTik] > /system package update [admin@MikroTik] > /system package install dude # Enable Dude server [admin@MikroTik] > /dude set enabled=yes # Access via web browser http://[router-ip]:80/dude/ # Features: • Network discovery • Real-time monitoring • Alert notifications • Traffic graphs

2. Netwatch

 # Monitor host availability [admin@MikroTik] > /tool netwatch add host=192.168.1.100 interval=30s timeout=5s up-script="/log info \"Host UP\"" down-script="/log warning \"Host DOWN\""
# Monitor multiple hosts
[admin@MikroTik] > /tool netwatch add host=8.8.8.8 interval=1m timeout=10s up-script="" down-script="/log error "Internet DOWN""
[admin@MikroTik] > /tool netwatch add host=192.168.1.1 interval=30s timeout=5s up-script="" down-script="/log warning "Gateway DOWN""

3. Traffic Flow

Traffic Flow adalah NetFlow/IPFIX implementation di MikroTik untuk traffic analysis dan accounting.

 # Enable Traffic Flow [admin@MikroTik] > /ip traffic-flow set enabled=yes interfaces=bridge-local # Configure flow target (collector) [admin@MikroTik] > /ip traffic-flow target add address=192.168.1.100:2055 version=9 # View flow information [admin@MikroTik] > /ip traffic-flow print [admin@MikroTik] > /ip traffic-flow target print

Security Monitoring Dashboard

Script: Security Status Report

 /system script add name=security-report source={ :log info "=== SECURITY STATUS REPORT ==="
# Check unauthorized MAC addresses
:local allowedMACs "AA:BB:CC:DD:EE:FF,11:22:33:44:55:66"
:foreach host in=[/interface bridge host find dynamic=yes] do={
 :local hostMAC [/interface bridge host get $host mac-address]
 :local hostInterface [/interface bridge host get $host interface]
 :if ([:find $allowedMACs $hostMAC] = "") do={
 :log warning "Unauthorized MAC: $hostMAC on $hostInterface"
 }
}

# Check for port security violations
:local portViolations [/interface bridge filter find action=drop]
:log info "Port security violations: $[:len $portViolations]"

# Check DHCP snooping status
:local dhcpBindings [/interface bridge host find dhcp=yes]
:log info "DHCP bindings: $[:len $dhcpBindings]"

# Check failed login attempts
:local failedLogins [/log find message~"login failed"]
:log warning "Failed login attempts: $[:len $failedLogins]"

# Generate report summary
:log info "=== REPORT COMPLETED ==="
}

Incident Response dan Alerting

1. Email Notifications

 # Configure email settings [admin@MikroTik] > /tool e-mail set address=smtp.gmail.com port=587 from="router@company.com" user="your-email@gmail.com" password="your-password" tls=yes
# Script untuk send alert email
[admin@MikroTik] > /system script add name=send-security-alert source={
/tool e-mail send to="admin@company.com" subject="Security Alert - Unauthorized Access" body="Unauthorized MAC address detected on port ether2"
}

# Schedule regular security reports
[admin@MikroTik] > /system scheduler add name=daily-security-report interval=1d on-event="/system script run security-report"

2. Telegram Bot Notifications

 # Script untuk send Telegram alert [admin@MikroTik] > /system script add name=telegram-alert source={ :local botToken "YOUR_BOT_TOKEN" :local chatID "YOUR_CHAT_ID" :local message "🚨 Security Alert: Unauthorized device detected" /tool fetch url="https://api.telegram.org/bot\$botToken/sendMessage?chat_id=\$chatID&text=\$message" mode=https }
# Trigger pada security event
[admin@MikroTik] > /system script add name=mac-violation-alert source={
:log warning "MAC violation detected"
/system script run telegram-alert
/system script run send-security-alert
}

Best Practices Port Security

✅ Checklist Implementasi Port Security

  1. Disable unused ports: /interface bridge port disable [find interface=etherX]
  2. Implement MAC address limiting: 2-3 MACs per port cukup
  3. Use static MAC binding untuk critical devices: Servers, printers, etc
  4. Enable DHCP snooping: Prevent rogue DHCP servers
  5. Configure port isolation: Untuk public access ports
  6. Regular monitoring: Review logs dan alerts daily
  7. Document all exceptions: Catat semua devices yang diizinkan
  8. Implement 802.1X jika possible: Untuk enterprise networks
  9. Regular audits: Monthly security audits
  10. Backup configurations: Sebelum perubahan security settings

Troubleshooting Port Security Issues

Issue Symptoms Diagnosis Commands Solution
Port Blocked No connectivity, MAC violation /interface bridge host print
/log print		 Check MAC limit, add to whitelist
DHCP Failure Can't get IP address /interface bridge host print where dhcp=yes
/ip dhcp-server lease print		 Check DHCP snooping, trusted ports
ARP Issues Intermittent connectivity /tool torch protocol=arp
/interface bridge filter print		 Check ARP inspection rules
High CPU Slow performance, packet drops /system resource print
/interface bridge filter print stats		 Optimize filter rules, reduce logging
False Alerts Too many security alerts /log print where topics=warning,error Adjust thresholds, whitelist legit devices

Compliance dan Reporting

1. Regular Security Audit Script

 /system script add name=security-audit source={ :local report ""
# 1. Check open ports
:report = ($report . "Open Ports:\n")
:foreach service in=[/ip service find enabled=yes] do={
 :local serviceName [/ip service get $service name]
 :local servicePort [/ip service get $service port]
 :report = ($report . " $serviceName : $servicePort\n")
}

# 2. Check disabled ports
:local disabledPorts [/interface bridge port find disabled=yes]
:report = ($report . "\nDisabled Ports: $[:len $disabledPorts]\n")

# 3. Check port security violations
:local violations [/log find message~"violation|unauthorized"]
:report = ($report . "Security Violations (7 days): $[:len $violations]\n")

# 4. Save report to file
/file print file=security-audit.txt
/file remove security-audit.txt
/file set security-audit.txt contents=$report

:log info "Security audit completed"
}

2. Compliance Checklist

  1. Monthly: Review semua security logs
  2. Monthly: Update MAC address whitelist
  3. Quarterly: Penetration testing
  4. Quarterly: Review dan update security policies
  5. Annually: Full security audit
  6. Annually: Security training untuk staff

Real-World Deployment Scenario

Scenario: Small Office Network Security

 OFFICE NETWORK SECURITY DESIGN [INTERNET] | [ROUTER] (MikroTik hEX) | [SWITCH] (Bridge dengan VLANs) | +--+--+--+--+ | | | | [IT] [Sales] [Guest] [Server] VLAN10 VLAN20 VLAN30 VLAN40 SECURITY IMPLEMENTATION: 1. Port 1-8: VLAN10 (IT) - MAC limiting 3 per port 2. Port 9-16: VLAN20 (Sales) - MAC limiting 2 per port 3. Port 17-20: VLAN30 (Guest) - Port isolation, no intra-VLAN comms 4. Port 21-24: VLAN40 (Servers) - Static MAC binding 5. All: DHCP snooping enabled 6. Trunk port: 802.1Q tagging, native VLAN 99 7. Monitoring: The Dude + Telegram alerts

Implementation Script:

 /system script add name=deploy-office-security source={ :log info "Deploying office security configuration..."
# VLAN Configuration
/interface bridge set bridge-local vlan-filtering=yes
/interface bridge vlan add bridge=bridge-local vlan-ids=10 untagged=ether2-ether8
/interface bridge vlan add bridge=bridge-local vlan-ids=20 untagged=ether9-ether16
/interface bridge vlan add bridge=bridge-local vlan-ids=30 untagged=ether17-ether20
/interface bridge vlan add bridge=bridge-local vlan-ids=40 untagged=ether21-ether24
/interface bridge vlan add bridge=bridge-local vlan-ids=99 untagged=ether1

# Port Security - IT Department
:for i from=2 to=8 do={
 /interface bridge filter add chain=forward in-interface="ether$i" src-mac-address=00:00:00:00:00:00/00:00:00:00:00:00 limit=3,1m action=drop
}

# Port Security - Sales Department
:for i from=9 to=16 do={
 /interface bridge filter add chain=forward in-interface="ether$i" src-mac-address=00:00:00:00:00:00/00:00:00:00:00:00 limit=2,1m action=drop
}

# Port Isolation - Guest Network
:for i from=17 to=20 do={
 /interface bridge port set [find interface="ether$i"] horizon=1
}

# Static MAC Binding - Servers
/interface bridge host add bridge=bridge-local interface=ether21 mac-address=AA:BB:CC:DD:EE:01 comment="Server1"
/interface bridge host add bridge=bridge-local interface=ether22 mac-address=AA:BB:CC:DD:EE:02 comment="Server2"

# DHCP Snooping
/interface bridge set bridge-local dhcp-snooping=yes
/interface bridge port set [find interface=ether1] trusted=yes

# Monitoring Setup
/tool netwatch add host=8.8.8.8 interval=1m down-script="/system script run internet-down-alert"
/system scheduler add name=daily-security-check interval=1d on-event="/system script run security-report"

:log info "Office security deployment completed"
}

Kesimpulan

Port security dan monitoring adalah komponen esensial dari defense-in-depth strategy untuk jaringan modern. Dengan mengimplementasikan:

  1. MAC address limiting dan binding
  2. Port isolation untuk segmentasi
  3. DHCP snooping dan ARP inspection
  4. Comprehensive monitoring dengan alerts
  5. Regular audits dan reporting

Anda dapat secara signifikan meningkatkan keamanan jaringan dan mengurangi risiko security breaches.

Action Plan untuk Implementasi:

  1. Week 1: Audit jaringan saat ini, identifikasi semua devices
  2. Week 2: Implement basic port security (MAC limiting)
  3. Week 3: Setup monitoring dan alerting system
  4. Week 4: Implement advanced features (DHCP snooping, DAI)
  5. Monthly: Review logs, update whitelists, run security audits

🔒 Keamanan adalah Yang Utama, Jaringan Tanpa Keamanan adalah Petaka!

Implement port security secara bertahap, monitor terus, dan selalu update defenses Anda.

Postingan Terkait

Formulir Kontak

Nama

Email *

Pesan *