Please enable JavaScript.

Coggle requires JavaScript to display documents.

MODULE 14 - Coggle Diagram

- - - - S1(config)# interface range fa0/8 - 24
      - S1(config-if-range)# shutdown
      - %LINK-5-CHANGED: Interface FastEthernet0/8, changed state to administratively down
      - (output omitted)
      - %LINK-5-CHANGED: Interface FastEthernet0/24, changed state to administratively down
      - S1(config-if-range)#
  - - - Switch(config-if)# switchport port-security mac-address mac-address
  - - - Port security aging can be used to set the aging time for static and dynamic secure addresses on a port. Two types of aging are supported per port:
        
        Absolute - The secure addresses on the port are deleted after the specified aging time.
        
        Inactivity - The secure addresses on the port are deleted only if they are inactive for the specified aging time.
- - - - Examine the Source MAC Address
        Every frame that enters a switch is checked for new information to learn. It does this by examining the source MAC address of the frame and the port number where the frame entered the switch. If the source MAC address does not exist, it is added to the table along with the incoming port number.
    - - Find the Destination MAC Address
        If the destination MAC address is a unicast address, the switch will look for a match between the destination MAC address of the frame and an entry in its MAC address table. If the destination MAC address is in the table, it will forward the frame out the specified port. If the destination MAC address is not in the table, the switch will forward the frame out all ports except the incoming port. This is called an unknown unicast.
  - - - In the figure, PC-D is replying back to PC-A. The switch sees the MAC address of PC-D in the incoming frame on port 4. The switch then puts the MAC address of PC-D into the MAC Address Table associated with port 4.
    - - Next, because the switch has destination MAC address for PC-A in the MAC Address Table, it will send the frame only out port 1, as shown in the figure.
    - - Next, PC-A sends another frame to PC-D, as shown in the figure. The MAC address table already contains the MAC address for PC-A; therefore, the five-minute refresh timer for that entry is reset. Next, because the switch table contains the destination MAC address for PC-D, it sends the frame only out port 4.
- - - - Use the following steps to mitigate VLAN hopping attacks:
      - Step 1: Disable DTP (auto trunking) negotiations on non-trunking ports by using the switchport mode access interface configuration command.
      - Step 2: Disable unused ports and put them in an unused VLAN. In the example it is VLAN 1000.
      - Step 3: Manually enable the trunk link on a trunking port by using the switchport mode trunk command.
      - Step 4: Disable DTP (auto trunking) negotiations on trunking ports by using the switchport nonegotiate command.
      - Step 5: Set the native VLAN to a VLAN other than VLAN 1 by using the switchport trunk native vlan vlan_number command.
  - - - Promiscuous - A promiscuous port can talk to everyone. It can communicate with all interfaces, including the isolated and community ports within a PVLAN.
      - Isolated - An isolated port can only talk to promiscuous ports. An isolated port has complete Layer 2 separation from the other ports within the same PVLAN, but not from the promiscuous ports. PVLANs block all traffic to isolated ports except traffic from promiscuous ports. Traffic from an isolated port is forwarded only to promiscuous ports.
      - Community - Community ports can talk to other community and promiscuous ports. These interfaces are separated at Layer 2 from all other interfaces in other communities or isolated ports within their PVLAN.
  - - - A protected port does not forward any traffic, such as unicast, multicast, or broadcast, to any other port that is also a protected port. Data traffic cannot be forwarded between protected ports at Layer 2; only control traffic is forwarded because these packets are processed by the CPU and forwarded in software. All data traffic passing between protected ports must be forwarded through a Layer 3 device.
      - Forwarding behavior between a protected port and a non-protected port proceeds as usual.
      - The default is to have no protected ports defined.
- - - - Wrong default gateway - The rogue server provides an invalid gateway, or its own IP address, to create a man-in-the-middle attack. This may go entirely undetected as the intruder intercepts the data flow through the network and then forwards it on to the real default gateway.
      - Wrong DNS server - The rogue server provides an incorrect DNS server address that points the user to a nefarious website.
      - Wrong IP address - The rogue server provides an invalid IP address which effectively creates a DoS attack on the DHCP client.
- - - - Not relaying invalid or gratuitous ARP Requests out to other ports in the same VLAN
      - Intercepting all ARP Requests and Replies on untrusted ports
      - Verifying each intercepted packet for a valid IP-to-MAC binding
      - Dropping and logging ARP Requests coming from invalid sources to prevent ARP poisoning
      - Error-disabling the interface if the configured DAI number of ARP packets is exceeded