- [Instructor] This lesson discusses many security threats
that focus on Layer 2 technologies
and addresses how to implement counter measures
against those threats.
Disrupt the bottom of the wall and the top is disrupted too,
everything at Layer 3 and higher is encapsulated
into some type of Layer 2 frame.
If the attacker can interrupt, copy, redirect
or confuse the Layer 2 forwarding of that data,
that same attacker can also disrupt any type
of upper layer protocols that are being used.
Let's look at some best practices
for securing your switches and then discuss in more detail
which best practice mitigates which type of attack.
Best practices for securing your infrastructure
including Layer 2, include the following;
one, select an unused VLAN other than VLAN 1
and use that for the native VLAN for all your trunks.
Do not use this native VLAN
for any of your enabled access ports.
Two, avoid using VLAN 1 anywhere
because it is but a default.
Three, administratively configure access ports
as access ports so that users cannot negotiate a trunk
and disable the negotiation of trunking
on Dynamic Trunking Protocol.
Four, limit the number of MAC addresses
learned on a given port with the port security feature.
Five, control spanning tree to stop users
or unknown devices from manipulating spanning tree.
You can do so by using the BPDU Guard
and Root Guard features.
Six, turn off Cisco Discovery Protocol CDP
on ports facing untrusted or unknown networks
that do not require CDP for anything positive.
CDP operates at Layer 2 and may provide attackers
information we would rather not disclose.
Seven, on a new switch shut down all ports
and assign them to a VLAN that is not used
for anything else other than a parking lot.
Then bring up the ports and assign correct VLANs
as the ports are allocated and needed.
To control whether a port is an access port or a trunk port,
you can revisit the commands used in an earlier lesson
including the ones shown in this example.
This example prevents a user
from negotiating a trunk with the switch maliciously
and then having full access to each of the VLANs
by using custom software on the computer
that can both send and receive .1Q tag frames.
A user with a trunk established
could perform VLAN hopping to any VLAN he desired
by just tagging frames with the VLAN of choice.
Other malicious tricks could be done as well
but forcing the port to an access port
with no negotiation removes this risk.
Cisco has many tools for protecting Layer 2
including the following, BPDU Guard,
if BPDUs show up where they should not,
the switch protects itself.
Root Guard controls which ports are not allowed
to become root ports to remote root switches.
Port security limits the number of MAC addresses
to be learned on an access switch port.
DHCP Snooping prevents rogue DHCP service
from impacting the network.
Dynamic ARP Inspection prevents spoofing
of Layer 2 information by hosts.
IP Source Guard prevents spoofing
of Layer 3 information by hosts.
802.1X allows you to authenticate users
before allowing their data frames into the network.
Storm control limits the amount of broadcast
or multicast traffic flowing through the switch.
And Access Control Lists control traffic
by enforcing policy.
The key Layer 2 security technologies focused
in the following sections include port security,
BPDU Guard, Root Guard, DHCP Snooping and Access Lists.