GoConqr hat ein neues Design! Sag uns, wie es dir gefällt.

Kostenlos registrieren

Karteikarten

2.1 Configure and verify switch security features

Dustin Sanders Networking CWNA Englisch 76 Karten

Karten in diesem Stapel (76)

  1. 1what is a DHCP relay agent?Relay agents forward requests and replies between clients and servers when they are not on the same physical subnet. Relay agent forwarding is different from the normal Layer 2 forwarding, in which IP datagrams are switched transparently between networks. Relay agents receive DHCP messages and generate new DHCP messages to send on output interfaces.
  2. 2what is DHCP snooping?provides network security by filtering untrusted DHCP messages and by building and maintaining a DHCP snooping binding database, also referred to as a DHCP snooping binding table.
    You use DHCP snooping to differentiate between untrusted interfaces connected to the end user and trusted interfaces connected to the DHCP server or another switch.
  3. 3what is DHCP Information Option (Option 82)(For large environments with multiple pools)
    DHCP relay is supposed to insert the “giaddr” field in the relayed DHCP packets, so that DHCP server may identify the pool to be used for the request.
  4. 4what kind of attack is DHCP snooping meant to mitigate?man in the middle attacks
  5. 5how does DHCP snooping work?A switch intercepts all DHCP requests coming from untrusted ports before flooding them throughout the VLAN. Any DHCP replies coming from an untrusted port are discarded because they must have come from a rogue DHCP server. In addition, the offending switch port automatically is shut down in the errdisable state.
  6. 6how do you enable DHCP snooping?Switch(config)# ip dhcp snooping
  7. 7how can you restrict DHCP snooping to specific vlans? Say if all the dhcp servers were on a management vlanSwitch(config)# ip dhcp snooping vlan 10,20
  8. 8by default are ports trusted or not with dhcp requests?not trusted, so you must specify which ports are trusted
  9. 9how do you specify a port as trusted?Switch(config)# interface gi0/0/1
    Switch(config-if)# ip dhcp snooping trust
  10. 10how can you see a detailed summary of the current state of dhcp snooping?switch# show ip dhcp snooping
  11. 11how can you see all the known dhcp bindings that have been overheard?Switch# show ip dhcp snooping [binding]
  12. 12gi1/0/35 and gi1/0/36 use VLAN 104 and are untrusted. A known good DHCP server is connected to GI1/1/1 How do you configure it?Switch(config)# ip dhcp snooping
    Switch(config)# ip dhcp snooping vlan 104
    Switch(config)# interface range gi 1/0/35 – 36
    Switch(config-if)# interface gi 1/1/1
    Switch(config-if)# ip dhcp snooping trust
  13. 13what is IP source guard and how does it work?A way of telling if an IP is coming from a legit host that's supposed to have that IP.
    Uses DHCP snooping table to check that an IP address coming in from a host connected to a port is actually what should be expected
  14. 14what must be configured first before IP guard?dhcp snooping and port security, since that's what IP guard uses to do its checks
  15. 15how can you configure a static IP source binding for a host that doesn't use DHCP? (like a server or something)Switch(config)# ip source binding mac-address vlan 10 ip-address interface gi0/0/10
  16. 16how do you enable port-security on a port?Switch(config)# interface gi0/0/5
    Switch(config-if)# ip verify source [port-security]
  17. 17what happens after you configureA port access control list (ACL) is applied to the interface. The port ACL allows only IP traffic with a source IP address in the IP source binding table and denies all other traffic.
  18. 18what kind of ACL takes precedence over an interface?As with all port ACLs, this port ACL takes precedence over any router ACLs or VLAN maps that affect the same interface.
  19. 19At what layer is IP source guard active?only on layer 2 ports
  20. 20Enable IP source guard with source IP and MAC filtering on VLANs 10 and 11:Switch# config t
    Switch(config)# interface gigabitethernet1/0/1
    Switch(config-if)# ip verify source port-security
    Switch(config-if)# exit
    Switch(config)# ip source binding 0100.0022.0010 vlan 10 10.0.0.2 interface gigabitethernet1/0/1
    Switch(config)# ip source binding 0100.0230.0002 vlan 11 10.0.0.4 interface gigabitethernet1/0/1
    Switch(config)# end
  21. 21how can you verify the IP source guard config on a switch?Switch# show ip verify source
  22. 22How does ARP find an unknown MAC address if it knows the IP address?It sends an ARP request broadcast saying "Hey, who has this IP address? What's your MAC address?" and the host with that IP responds "hey, I got that, this is my MAC"
    works well if the host isn't a filthy dirty lying whore. That's where Dynamic ARP inspection comes in.
  23. 23what is the name of the attack where someone injects their own ARP reply with a MAC address to misdirect traffic?ARP spoofing/ARP poisoning
  24. 24What is Dynamic ARP inspection?Dynamic ARP inspection associates a trust state with each interface on the switch. Packets arriving on trusted interfaces bypass all dynamic ARP inspection validation checks, and those arriving on untrusted interfaces undergo the dynamic ARP inspection validation process.
  25. 25what is the point of rate limiting ARP inspections on an untrusted interface?The CPU has to inspect each ARP packet. IF you don't rate limit it, someone could flood the interface with ARP packets and lock up the CPU
    standard limit is 15pps (packets per second)
  26. 26what does a switch do when it drops a packet?it places an entry in the log buffer and then generates system messages on a rate-controlled basis. After the message is generated, the switch clears the entry from the log buffer. Each log entry contains flow information, such as the receiving VLAN, the port number, the source and destination IP addresses, and the source and destination MAC addresses.
  27. 27In which direction does dynamic ARP work?Dynamic ARP inspection is an ingress security feature; it does not perform any egress checking.
  28. 28how can you control ARP packets in non-dhcp environments when dhcp snooping is disabled?use ARP ACLs to permit or to deny packets.
  29. 29where is dynamic ARP inspection supported?Dynamic ARP inspection is supported on access ports, trunk ports, EtherChannel ports, and private VLAN ports
  30. 30how can you enable Dynamic Arp Inspection (DAI) on one or more client vlans?Switch(config)# ip arp inspection vlan vlan-range
    (by default all ports in range are considered untrusted)
  31. 31how can you configure an interface as a trusted port?Switch(config)# interface type member/module/number
    Switch(config-if)# ip arp inspection trust
  32. 32how do you define an ARP ACL with a static entry?Switch(config)# arp access-list acl-name
    Switch(config-acl)# permit ip host sender-ip mac host sender-mac [log] [Repeat the previous command as needed]
    Switch(config-acl)# exit
  33. 33How do you apply an ARP ACL with a static entry?Switch(config)# ip arp inspection filter arp-acl-name vlan vlan-range [static]
  34. 34Configuring DAI to Validate ARP Replies where DAI is enabled for all switch ports associated with VLAN 104 on an access layer switch. The uplink to a distribution switch (Gigabit Ethernet 1/0/49) is considered to be trusted.Switch(config)# ip arp inspection vlan 104
    Switch(config)# arp access-list StaticARP
    Switch(config-acl)# permit ip host 192.168.1.10 mac host 0006.5b02.a841
    Switch(config-acl)# exit
    Switch(config)# ip arp inspection filter StaticARP vlan 104
    Switch(config)# interface gigabitethernet 1/0/49
    Switch(config-if)# ip arp inspection trust
  35. 35how can you Verify detailed information about ARP ACLs.Switch# show arp access-list[acl-name]
  36. 36how can you Verify the trust state and the rate limit of ARP packets for the specified interface or all interfaces.Switch# show ip arp inspection interfaces [interface-id]
  37. 37Verify the configuration and the operating state of dynamic ARP inspection for the specified VLAN.Switch# show ip arp inspection vlan vlan-range
  38. 38Clears dynamic ARP inspection statistics.Switch# clear ip arp inspection statistics
  39. 39Clears the dynamic ARP inspection log buffer.Switch# clear ip arp inspection log
  40. 40Displays the configuration and contents of the dynamic ARP inspection log buffer.Switch# show ip arp inspection log
  41. 41How can you enable switchport security on an interface?Switch(config-if)# switchport port-security
  42. 42After enabling switchport security on a port, what must you do?identify a set of allowed MAC addresses
    Switch(config-if)# switchport port-security maximum max-addr
  43. 43how can you make the learned addresses persistent across a switch rebootSwitch(config-if)# switchport port-security mac-address sticky
  44. 44how can you statically define one or more MAC addresses on an interfaceSwitch(config-if)# switchport port-security mac-address mac-addr
  45. 45what three states can a port take upon a security violation?shutdown
    restrict (violating packets dropped)
    protect (like restrict, but no log)
  46. 46how can you verify port security status?Switch# show port-security int
  47. 47Verify Summary Information for Ports in the Errdisable StateSwitch# show interfaces status err-disabled
  48. 48erify Port Security Status Summary InformationSwitch# show port-security
  49. 49What are private VLANs?Say you have a bunch of servers on 1 vlan. You want them all on 1 vlan, but the servers don't need to talk to each other, only send/get traffic.
    Private VLANs let you further break up a vlan and isolate hosts on the same vlan
  50. 50What's another name for private vlans?secondary vlans
  51. 51what are the two types of private vlans?Isolated and community
  52. 52what is an isolated private vlan?Any switch ports associated with an isolated VLAN can reach the primary VLAN but not any other secondary VLAN. In addition, hosts associated with the same isolated VLAN cannot reach each other. They are, in effect, isolated from everything except the primary VLAN.
  53. 53what is a community vlan?Any switch ports associated with a common community VLAN can communicate with each other and with the primary VLAN but not with any other secondary VLAN. This provides the basis for server farms and workgroups within an organization, while giving isolation between organizations.
  54. 54does VTP carry any PVLAN information?nope. private vlans only matter on the switch where they are configured
  55. 55what must you do for each port in a private vlan?configure that port and define either promiscuous or host mode
  56. 56what is promiscuous mode in a pvlan port configuration?The switch port connects to a router, firewall, or other common gateway device. This port can communicate with anything else connected to the primary or any secondary VLAN. In other words, the port is in promiscuous mode, in which the rules of private VLANs are ignored.
  57. 57what is Host mode in a pvlan port configuration?The switch port connects to a regular host that resides on an isolated or community VLAN. The port communicates only with a promiscuous port or ports on the same community VLAN.
  58. 58how do you define a private vlan?Switch(config)# vlan vlan-id
    Switch(config-vlan)# private-vlan {isolated | community}
  59. 59don't forget!associate the primary vlan with its componenet secondar vlans using the association keyword
    Switch(config-vlan)# private-vlan association
  60. 60how do you define if a port will operate in host or promiscuous mode with the private vlan?Switch(config-if)# switchport mode private-vlan {host | promiscuous}
  61. 61what is switch spoofing?when a malicious users pretends to be a switch to try and get a switch to trunk with them (if DTP is left on default for every interface this could happen)
  62. 62what is the solution to switch spoofing?configure every non trunking port to static access
  63. 63what is vlan hopping?crafting a frame that is double tagged with 802.1q tags so that the first tag is removed and there is a 2nd 802.1q tag to trick the switch into forwarding to another vlan
  64. 64what conditions must be met for vlan hopping to work?The attacker is connected to an access switch port.
    The same switch must have an 802.1Q trunk.
    The trunk must have the attacker’s access VLAN as its native VLAN.
  65. 65how can you prevent vlan hopping?Step 1. Set the native VLAN of a trunk to a bogus or unused VLAN ID.
    Step 2. Prune the native VLAN off both ends of the trunk.
  66. 66How would you configure setting a native vlan of a trunk to 800 and pruning (or removing) vlan 800 to stop vlan hopping?Switch(config)# vlan 800
    Switch(config-vlan)# name bogus_native
    Switch(config-vlan)# exit
    Switch(config)# interface gigabitethernet 1/0/1
    Switch(config-if)# switchport trunk encapsulation dot1q
    Switch(config-if)# switchport trunk native vlan 800
    Switch(config-if)# switchport trunk allowed vlan remove 800
    Switch(config-if)# switchport mode trunk
  67. 67what is an alternative way to stop vlan hopping?force all 802.1Q trunks to add tags to frames for the native VLAN
  68. 68how would you force all 802.1Q trunks to add tags to frames for the native VLANSwitch(config)# vlan dot1q tag native
  69. 69what is a LAN storm?A LAN storm occurs when packets flood the LAN, creating excessive traffic and degrading network performance. Errors in the protocol-stack implementation, mistakes in network configurations, or users issuing a DoS attack can cause a storm.
  70. 70what is storm control?SC monitors packets from an int to the switching bus and sees if they are unicast/multicast/broadcast and compares that to pre-defined suppression threshold.
  71. 71what 3 ways does storm control measure traffic activity?bandwidth as % of total available
    traffic rate in pps
    traffic rate in bps (bits per second)
  72. 72when a SC multicast threshold is reached, what traffic is blocked?all multicast traffic except BPDU and CDP frames.
  73. 73where is SC configured?on a per interface basis
  74. 74how do you configure storm control?type of traffic, then type of threshold
    Switch(config-if)# storm-control broadcast leve bps
  75. 75when does SC kick in?Storm Control will take action when the flooded traffic rises to the first value, then will stop the action when the traffic falls below that value. You can set a different falling threshold by specifying the second – low value.
  76. 76how can you shut down an interface and send an snmp message instead of dropping frames?Switch(config-if)# storm-control action {shutdown | trap}

Informationen

Beschreibung
CWNA Networking (CCNP Switch Exam Topics) Karteikarten am 2.1 Configure and verify switch security features, erstellt von Dustin Sanders am 21/01/2017.
Erstellt von
Dustin Sanders
Aufrufe
0
Verlauf
  • Erstellt von Dustin Sanders · 21 Jan 2017
  • Kopiert von Dustin Sanders · 21 Jan 2017
  • Kopiert von Dustin Sanders · 21 Jan 2017
  • Kopiert von Dustin Sanders · 21 Jan 2017
  • Kopiert von Dustin Sanders · 21 Jan 2017
  • Kopiert von Dustin Sanders · 21 Jan 2017
  • Kopiert von Dustin Sanders · 21 Jan 2017
  • Kopiert von Dustin Sanders · 21 Jan 2017
Bewertung

Feedback

Worum geht es?

Wie gefällt dir das neue Design?

Dein Eindruck