Tutorial 6.11: Link-Layer Security and Network Protection Mechanisms

(b) MAC flooding. This attack overwhelms the CAM table.

(b) To validate ARP packets and prevent ARP spoofing. DAI uses the DHCP snooping binding table.

(b) Port security. It limits MAC addresses per port.

(b) VLAN 1. It is the default native VLAN.

(c) IEEE 802.1X. It is the standard for port-based authentication.

(b) The switch floods all frames to all ports. This is because the CAM table is full.

(b) IP Source Guard. It filters based on IP-MAC bindings.

(b) The attacker negotiates a trunk with the switch using DTP. This gives access to all VLANs.

(a) To prevent rogue DHCP servers. It only allows DHCP replies on trusted ports.

(b) Use a unused VLAN (e.g., 999) for native VLAN. This prevents VLAN hopping.

(b) Encryption for Ethernet frames. MACsec provides link-layer confidentiality and integrity.

(c) Shutdown. The port is error-disabled.

(a) RADIUS. The switch acts as an authenticator and uses RADIUS.

(b) To disable the port if a BPDU is received. It prevents rogue switches.

(b) Using Dynamic ARP Inspection (DAI). DAI validates ARP packets.

(a) Man-in-the-middle attack. ARP poisoning redirects traffic to the attacker.

(b) DHCP snooping. It blocks DHCP server replies on untrusted ports.

(b) The client device seeking network access. The supplicant is the client.

(b) MAC flooding. CAM table overflow causes flooding.

(a) To permanently learn MAC addresses. Sticky MAC addresses are saved in the configuration.

(a) AES-128 (GCM mode). MACsec uses AES-128 GCM.

(b) It is vulnerable to VLAN hopping attacks. VLAN 1 is the default native VLAN and is often targeted.

(a) Use a different native VLAN for trunks. Change native VLAN to an unused VLAN.

(a) To prevent IP spoofing. IP Source Guard filters traffic based on the DHCP binding table.

(d) Both (b) and (c). The authenticator enforces the decision made by the authentication server.

(b) Hosts experiencing intermittent connectivity. ARP spoofing can redirect traffic incorrectly.

(a) DHCP snooping. It only allows DHCP replies on trusted ports.

(b) It is the network device (switch) that controls port access. The authenticator enforces authentication.

(a) Enable BPDU Guard on all access ports. This prevents rogue switches.

(a) To provide authentication and encryption for Ethernet frames. MACsec secures link-layer communication.

(a) 1. Default is 1 MAC address per port.

(b) DHCP messages on untrusted ports are filtered. It prevents rogue DHCP servers.

(b) ARP poisoning. It redirects traffic through the attacker.

(b) Restrict generates logs; protect does not. Restrict sends a syslog/SNMP trap; protect drops frames silently.

(a) MACsec. MACsec encrypts traffic on trunk links.

(b) It allows dynamic VLAN assignment based on user identity. 802.1X can assign VLANs and policies per user.

(b) Dynamic ARP Inspection. DAI validates ARP packets using the binding table.

(a) To limit broadcast, multicast, and unknown unicast traffic. Storm control prevents denial-of-service from flooding.

(b) Access ports connected to end devices. Port security is typically used on access ports.

(a) Setting native VLAN to an unused VLAN. This prevents the attacker from exploiting the native VLAN.

interface gigabitEthernet 0/1
 switchport mode access
 switchport port-security
 switchport port-security maximum 5
 switchport port-security violation shutdown
 switchport port-security mac-address sticky
        

ip dhcp snooping
ip dhcp snooping vlan 10
interface gigabitEthernet 0/24
 ip dhcp snooping trust
        

ip arp inspection vlan 20
interface gigabitEthernet 0/2
 ip arp inspection trust
        

The attacker sends a frame with two 802.1Q tags. The outer tag is for the native VLAN of the first switch (which strips it). The inner tag is for the target VLAN. The first switch forwards the frame to the trunk with only the inner tag, and the second switch receives it and forwards it to the target VLAN. Requirements: the attacker must be on the same native VLAN as the trunk, and the trunk must have the native VLAN set to the same VLAN as the attacker's port.

1. Enable Dynamic ARP Inspection (DAI) on the VLAN.
2. Ensure DHCP snooping is enabled and trusted ports are correctly configured.
3. Implement port security to limit MAC addresses on access ports.

• Set the native VLAN to an unused VLAN (e.g., 999).
• Explicitly allow only required VLANs on the trunk.
• Disable DTP (set trunk mode to "trunk" manually).
• Ensure the native VLAN is not used for user traffic.

aaa new-model
radius-server host 192.168.1.100 key secret
aaa authentication dot1x default group radius
dot1x system-auth-control
interface gigabitEthernet 0/1
 authentication port-control auto
 dot1x pae authenticator
        

interface gigabitEthernet 0/3
 ip verify source port-security
        

Port security limits the number of MAC addresses per port, preventing an attacker from flooding the CAM table from a single port. MAC address aging ensures that entries eventually expire, allowing the switch to recover from an attack. Also, storm control can limit the rate of unknown unicast frames.

BPDU Guard: Shuts down a port if a BPDU is received, used on access ports to prevent rogue switches. Root Guard: Prevents a port from becoming a root port; if a superior BPDU is received, the port is blocked. Used on ports that should not become root, typically downstream links.

interface gigabitEthernet 0/1
 switchport trunk encapsulation dot1q
 switchport mode trunk
 switchport trunk native vlan 999
 switchport trunk allowed vlan 10,20,30
 switchport nonegotiate
        

Enable MACsec globally, configure a key chain, and apply the security policy to the interface. For example:

macsec
key chain MACSEC_KEY
 key 1
  key-string 
 interface gigabitEthernet 0/1
  macsec
  macsec key chain MACSEC_KEY
        

DHCP snooping watches DHCP exchanges on trusted ports and records IP-MAC-VLAN-port bindings in a table. DAI uses this table to validate ARP packets (matching source IP to MAC). IPSG uses it to filter IP packets (allowing only packets from the bound IP/MAC).

BPDU Guard prevents a rogue switch from participating in STP, which could cause topology changes, loops, or even become the root bridge. Without BPDU Guard, a rogue switch could cause network instability or man-in-the-middle attacks.

1. Enable port security on access ports.
2. Enable DHCP snooping, DAI, and IPSG.
3. Use 802.1X for user/device authentication.
4. Change native VLAN on trunks to an unused VLAN.
5. Enable BPDU Guard on access ports and Root Guard on appropriate ports.

Monitor ARP tables for inconsistencies (e.g., multiple IPs mapping to same MAC). Use tools like arpwatch, Wireshark (filter for ARP replies with different MACs), or switch logs from DAI. DAI will log dropped ARP packets when it detects a violation.

Use the command shutdown followed by no shutdown on the interface, or enable errdisable recovery cause psecure-violation globally.

MAB is used for devices that do not support 802.1X, such as printers, IP cameras, or legacy devices. The switch uses the device's MAC address to authenticate against the RADIUS server. Limitations: MAC addresses can be spoofed, and MAB is less secure than certificate-based authentication.

An attacker sends many DHCP requests with spoofed MAC addresses to exhaust the DHCP server's pool of addresses, preventing legitimate clients from obtaining IPs. Mitigation: DHCP snooping with rate limiting on untrusted ports, and setting the DHCP server to detect and block such attacks.

Use SSH instead of Telnet, enable AAA with TACACS+/RADIUS for authentication, use SNMPv3 with encryption, restrict management IPs via ACLs, use a dedicated management VLAN, and disable unused services (e.g., HTTP, CDP).

DHCP snooping builds a binding table of IP-MAC-VLAN-port. DAI uses this table to validate ARP packets, preventing ARP spoofing. IPSG uses the table to filter IP traffic, preventing IP spoofing. Together, they provide a comprehensive defense against IP and ARP-based attacks.

Shutdown: disables the port, useful for high-security areas where immediate action is needed. Restrict: drops violating frames and logs, good for monitoring. Protect: drops violating frames silently, used when you want to limit impact on the network.

Double tagging: attacker sends a frame with two tags; the first switch strips the outer tag (native VLAN) and forwards the inner tag. The second switch forwards based on the inner tag. This works if the attacker is on the same native VLAN as the trunk and the native VLAN is VLAN 1 (default). Prevention: change native VLAN to an unused VLAN, and never use VLAN 1 for user traffic.

1. Supplicant connects to the switch port.
2. Switch (authenticator) sends EAP-Request/Identity to supplicant.
3. Supplicant responds with EAP-Response/Identity.
4. Switch encapsulates the response in RADIUS and forwards to authentication server.
5. Authentication server challenges the supplicant (e.g., EAP-TLS, PEAP).
6. Supplicant and server authenticate each other.
7. Authentication server sends RADIUS-Accept to switch.
8. Switch grants access to the port, optionally assigns VLAN.

MACsec operates at Layer 2, protecting Ethernet frames between directly connected devices. IPsec operates at Layer 3, protecting IP packets end-to-end. MACsec is suitable for campus or data center links where encryption is needed on physical links; IPsec is used for VPNs and across untrusted networks. MACsec is simpler for point-to-point links, but IPsec provides more flexibility and works over the internet.

Trusted ports are those from which we accept DHCP replies (DHCP snooping) and ARP packets (DAI) without validation. Uplink ports are trusted because they connect to legitimate servers (DHCP server, router). This allows valid traffic while protecting against rogue devices on access ports.

Sticky MAC dynamically learns MAC addresses and stores them in the running configuration, making them persistent across reboots. Advantages: no need to manually configure each MAC; provides a permanent record. Disadvantages: if a device is replaced, the new MAC must be added or the port reconfigured; also, sticky MAC addresses are not automatically removed if a device moves.

Guest VLAN is used for visitors who need internet access but should not access internal resources. Security measures: isolate guest VLAN from internal VLANs (via ACLs), limit bandwidth, enable DHCP snooping and DAI, use 802.1X for guest authentication (often with captive portal), and apply micro-segmentation to prevent guest-to-guest attacks.

Storm Control limits the rate of broadcast, multicast, and unknown unicast traffic on a port. When the rate exceeds a threshold, the switch drops subsequent frames. It is important to prevent denial-of-service due to broadcast storms (e.g., from loops or attacks) and to protect against switch CPU overload.

The RADIUS server authenticates the supplicant and returns an authorization decision (accept/reject) and optionally VLAN assignment. The switch acts as a RADIUS client, encapsulating EAP messages in RADIUS packets and sending them to the server over UDP (ports 1812/1813).

MAC flood overwhelms the CAM table, causing the switch to flood all traffic, allowing sniffing. MAC spoof is impersonating a specific MAC to redirect traffic. MAC spoof can lead to targeted MitM attacks, while MAC flood is broader but less stealthy. MAC spoof can be more dangerous if the attacker impersonates a gateway.

Commands: show ip dhcp snooping (status, trust settings), show ip dhcp snooping binding (list of bindings), show ip dhcp snooping statistics (counters). Also check logs for DHCP snooping messages.

IP Device Tracking is a feature that tracks IP addresses of devices on a port, often used with DAI when DHCP snooping is not available. It uses probes to detect active IPs. DHCP snooping relies on DHCP messages; IP Device Tracking can work with static IPs.

The attacker sends forged ARP replies associating the gateway IP with the attacker's MAC. All traffic to the gateway goes through the attacker, who can sniff SSH sessions (unless encrypted). DAI would have detected the invalid ARP reply (since the MAC doesn't match the DHCP binding) and dropped it, preventing the attack.

MACsec encrypts all Ethernet frames on the trunk. It uses a pre-shared key or MKA (MACsec Key Agreement) protocol to establish encryption keys. MKA uses 802.1X authentication to derive keys securely.

VLAN 1 is the default native VLAN and is often targeted for VLAN hopping. Attackers can exploit it. Mitigate by moving management to a dedicated VLAN, changing native VLAN to an unused VLAN, and blocking VLAN 1 on trunks.

Static ARP entries are effective but require manual configuration on every device and are not scalable. DAI is automated and uses DHCP bindings, making it scalable and easier to manage for large networks. DAI is preferred in enterprise environments.

Micro-segmentation uses VXLAN overlays to create small, isolated network segments. This limits east-west traffic and reduces attack surface. Security policies can be applied per segment, and VXLAN provides L2 isolation across L3, enhancing security.

AAA provides centralized authentication (who is accessing the device), authorization (what they can do), and accounting (logging). It complements Layer 2 protections by securing management access to switches, ensuring only authorized administrators can change configurations, which could otherwise disable security features.

• Disable unused ports.
• Set access ports to VLAN (not trunk).
• Enable port security with sticky MAC and shutdown violation.
• Enable DHCP snooping, DAI, and IPSG on all user VLANs.
• Configure trunks with native VLAN 999 and allow only necessary VLANs.
• Enable BPDU Guard on access ports.
• Enable Root Guard on distribution ports.
• Use 802.1X with RADIUS for user authentication.
• Enable SSH, disable Telnet, and use AAA.
• Enable logging and SNMPv3.
• Set management VLAN to a dedicated VLAN.
• Apply ACLs to restrict management access.