Please enable JavaScript.

Coggle requires JavaScript to display documents.

Module 14: Layer 2 Security Considerations, 14.4 Mitigate VLAN Attacks, 14…

- - - - Security is only as strong as the weakest link in the system, and Layer 2 is considered to be that weakest link. This is because traditionally LANs were under the administrative control of a single organization. We inherently trusted all persons and devices connected to our LAN. Today, with BYOD and more sophisticated attacks, our LANs have become more vulnerable to penetration. Therefore, in addition to protecting Layer 3 to Layer 7, network security professionals must also mitigate attacks to the Layer 2 LAN infrastructure.
        The first step in mitigating attacks on the Layer 2 infrastructure is to understand the underlying operation of Layer 2 and the threats posed by the Layer 2 infrastructure.
        
        Attacks against the Layer 2 LAN infrastructure are highlighted in the table.
      - The figure below provides an overview of Cisco solutions that help mitigate Layer 2 attacks.
      - These Layer 2 solutions will not be effective if the management protocols are not secured. An example would be if attackers can easily telnet into a switch. Syslog, SNMP, TFTP, telnet, FTP and most other common network management protocols are insecure. Therefore, the following strategies are recommended:
        
        Always use secure variants of these protocols such as SSH, SCP, and SSL.
        
        Consider using out-of-band (OOB) management.
        
        Use a dedicated management VLAN where nothing but management traffic resides.
        
        Use ACLs to filter unwanted access.
- - - - Learn
        
        Examine the Source MAC Address.
        
        A switch learns by examining the source MAC address and port of incoming frames. If the MAC address is new, it's added to the table with the port number. If it already exists, the timer for the entry is refreshed (default: 5 minutes). If the same MAC address appears on a different port, the entry is updated with the new port.
      - Forward
        
        Find the Destination MAC Address
        
        A switch checks its MAC address table for the destination MAC address. If it's a unicast address and found in the table, the frame is forwarded to the specified port. If not, the frame is sent out all ports except the incoming one (unknown unicast). Broadcast and multicast frames are also flooded to all ports except the incoming port.
  - - - In the figure, PC-D is replying back to PC-A. The switch sees the MAC address of PC-D in the incoming frame on port 4. The switch then puts the MAC address of PC-D into the MAC Address Table associated with port 4.
    - - Next, because the switch has destination MAC address for PC-A in the MAC Address Table, it will send the frame only out port 1, as shown in the figure.
    - - Next, PC-A sends another frame to PC-D, as shown in the figure. The MAC address table already contains the MAC address for PC-A; therefore, the five-minute refresh timer for that entry is reset. Next, because the switch table contains the destination MAC address for PC-D, it sends the frame only out port 4.
- - - - The following example shows an administrator changing the security violation to “restrict”. The output of the show port-security interface command confirms that the change has been made.
  - - - To display port security settings for the switch, use the show port-security command. The example indicates that only one port is configured with the switchport port-security command.
    - - Use the show port-security interface command to view details for a specific interface, as shown previously and in this example.
    - - To verify that MAC addresses are “sticking” to the configuration, use the show run command as shown in the example for FastEthernet 0/19.
    - - To display all secure MAC addresses that are manually configured or dynamically learned on all switch interfaces, use the show port-security address command as shown in the example.
- - - - FastEthernet ports 0/1 through fa0/16 are active access ports
      - FastEthernet ports 0/17 through 0/20 are not currently in use
      - FastEthernet ports 0/21 through 0/24 are trunk ports.
    - - FastEthernet ports 0/1 to 0/16 are access ports and therefore trunking is disabled by explicitly making them access ports.
      - FastEthernet ports 0/17 to 0/20 are unused ports and are disabled and assigned to an unused VLAN.
      - FastEthernet ports 0/21 to 0/24 are trunk links and are manually enabled as trunks with DTP disabled. The native VLAN is also changed from the default VLAN 1 to VLAN 999.
- - - - Step 1. Enable DHCP snooping by using the ip dhcp snooping global configuration command.
      - Step 2. On trusted ports, use the ip dhcp snooping trust interface configuration command.
      - Step 3. Limit the number of DHCP discovery messages that can be received per second on untrusted ports by using the ip dhcp snooping limit rate interface configuration command.
      - Step 4. Enable DHCP snooping by VLAN, or by a range of VLANs, by using the ip dhcp snooping vlan global configuration command.