- [Instructor] NAC or network access control is a technology
that is specifically designed to interrogate endpoints
before they join a wired or wireless network.
And basically, it is typically used in conjunction
with 802 dot one x, for identity management,
and for enforcement.
Now, in short, network access control is actually done,
within switches, or by wireless access points.
And they can be configure to authenticate end users,
and then perform other security posture assessments,
on the endpoint device to enforce that policy.
So for example, it can check whether you actually
have a security software like an antivirus anti malware,
or personal firewall before it allows
you to join the network.
You can also check to see if you have a specific version
of an operating system or specific patch.
Whether you have a patch, or have patch
for specific vulnerability unsewn.
Now, many neck solutions actually use a client base agent
to perform endpoint security posture assessments.
And actually to prevent an endpoint from joining
the network until it is actually evaluated.
Also, some switches can be configure to send an SNMP trap
when a new Mac address is actually registered with a certain
switch port and to trigger the neck process.
Now NAC implementations can allow you to configure specific
notes like printers, IP phones and video
conferencing equipment, to join the network by using
a white list of MAC addresses corresponding
to those devices.
That process is known as the Mac Auth
or a Mac authentication bypass.
Now a network administrator can actually pre configure
or manually change these access levels.
For example, a device access in a specific VLAN
let's say VLAN 10, must be manually predefined
for a specific port by an administrator.
And this actually makes, this a little bit more complex
because they're deploying a dynamic
network policy across multiple ports, using port security
is extremely difficult to maintain.
Now an attacker can easily spoofed
an authorized MAC address, let's say a MAC address
of an IP phone of a switch or a printer and potentially
bypass any NAC or network access control policies,
that may be on that switch port.
And this is because a port for which Mac Auth bypasses
actually enable can be dynamically enable or disable based
on the MAC address of the device
it is actually connecting to.
Another thing that I want to actually share with you,
is how to perform or what are VLAN hopping attacks, right.
And what is actually VLAN hopping?
Now, if you're not familiar with the VLAN,
basically a VLAN stands for virtual LAN.
And it's another name for layer two broadcast domain.
Now a VLAN is actually controlled by a switch.
The switch also controls ports that are associated
with which VLANs are configure.
Now in this example, if the switchers are in their default
configuration, all ports, by default,
are assigned to VLAN one, which actually means
that all the devices, including the two users,
and the router that is actually connected, to the switch,
or in the same broadcast domain, or the same VLAN .
Now, as you start adding hundreds of users,
you may actually want to separate those groups of users
into individual subnets and associate
individual VLANs to those entities.
Now to do this, you actually assign the switch port
to the VLAN, and then any device that actually connects
to that specific port is a member of that VLAN.
Now, hopefully, all the devices actually are connected
to the switch ports are assigned to a given VLAN.
And also have a common IP network address configure,
so that they can actually communicate with each other
in the same VLAN.
Now often Dynamic Host control Configuration Protocol
or DHCP, is used to assign IP addresses
from a, common subnet range, to the devices
in a specific VLAN, right?
So that provisioning is a little bit easier,
in many implementations.
Now one problem is actually whenever you have two users
in the same VLAN, but not on the same physical switch,
how switch one will actually tell switch two,
that a broadcast or a unicast,
actually frame is actually supposed
to be let's say, for VLAN 10.
Now the solution is pretty simple for connections between
two switches that contain ports in VLANs, that basically
assist on both switches, you configure a specific
trunk ports instead of configuring access ports.
So again, trunking is a methodology that allows you to share
the VLAN information between multiple switches.
Now, if the two switch ports are configured as trunks,
they include additional information, which actually is often
referred to as a tag.
And that tag identifies which VLAN
each frame will belong to.
Now, there's a standard protocol
for doing this type of tagging.
And that protocol is called the 802 dot one Q protocol.
Of the most critical piece of information, for this example,
in this tag is that VLAN ID.
Now host A and host B communicate with each other.
And they can communicate with other devices
in the same VLAN.
Which is also the same IP subnet.
Now, but they cannot communicate with devices outside
their local VLAN without the assistance of a gateway,
right, or a router.
Now a router can actually be implemented with two physical
interfaces, one connecting to an access port on the switch
that is actually been assigned to VLAN 10.
And another one connected to a different access port
that has been configured for a different VLAN.
And then basically, it can route packets between those two
distinct broadcast domains or broke
or VLANs in this example.
Now with two physical interfaces, and a different IP address
on each of those interfaces.
The router then can perform that routing
between those two VLANs.
Now that you're familiar with VLANs and their purpose,
Let's actually go over of what is actually
VLAN Hopping right?
VLAN hopping is a method of gaining access
to traffic on other VLANs that you will not typically
will have access to.
Now there are two primary methods to do VLAN hopping.
One is actually by doing switch spoofing, and the other one
is a methodology called double tagging.
Now, whenever you perform a switch spoofing attack,
you imitate the trunking switch by sending the respective
VLAN tag and their specific trunking protocol.
Now, several best practices actually can help mitigate
this VLAN hopping and other layer two attacks.
And these are a few examples of those type
of integrations, right?
First one is actually to select an unused VLAN
other than VLAN one, so don't leave your switch.
Just running VLAN one and use it as the native VLAN
for all your trunk, so let's say you select VLAN 10,
then use that as the VLAN that is native
or native VLAN for all your trunks.
Do not use this native VLANs
for any of your enable access ports.
Now also configure switch ports as access ports
so that users cannot negotiate a trunk.
Also disable the negotiation of trunking.
That means that you don't allow
the dynamic trunking protocol or DTP.
You also can limit the number of MAC addresses
that are learned on a given port with port security,
or the port security feature.
You can also control spanning tree to stop users
or rogue devices or unknown devices from manipulating it.
You can also do this by using their BPDU guard
and Root Guard features in many different switches,
including Cisco switches as well.
Now another best practice is actually
that whenever you should get a new switch,
you should shut down all ports and assign them to a VLAN
that is actually not used for anything else.
And that's what we actually call VLAN parking
or a parking lot, right?
And then you actually bring those ports up
whenever you have a, legitimate device actually connected
to it, and then assign those to the correct VLAN,
as the ports are actually allocated.
Now, in many different complex environments,
I know that this is actually easier said than done
just because of the dynamic nature of devices,
and many things actually being connected
now into corporate environments.
So a lot of people actually are using mostly a wireless
communication for their users
and the user population, right?
But whenever you actually have things like a call center,
whether you have static workstations,
that they actually don't move out of that call center.
That's actually something that you can use
some of these best practices.
So you protect against VLAN hopping attacks.