Switch Security Configuration

Switch Security Configuration

1. Implement Port Security

   • Secure Unused Ports
     • A simple method to help secure the network from unauthorized access is to disable all unused ports on a switch.
       • S1(config)# interface range fa0/8 - 24 S1(config-if-range)# shutdown
   • Mitigate MAC Address Table Attacks
     • The simplest and most effective method to prevent MAC address table overflow attacks is to enable port security.
   • Enable Port Security
     • Port security can only be configured on manually configured access ports or manually configured trunk ports.
       • S1(config-if)# switchport mode access S1(config-if)# switchport port-security S1# show port-security interface
   • Limit and Learn MAC Addresses
     • To set the maximum number of MAC addresses allowed on a port, use the ommand
       • Switch(config-if)# switchport port-security maximum value
     • The switch can be configured to learn about MAC addresses on a secure port in one of three ways
       • 1. Manually Configured
         • Switch(config-if)# switchport port-security mac-address mac-address
       • 2. Dynamically Learned
       • 3. Dynamically Learned – Sticky
         • Switch(config-if)# switchport port-security mac-address sticky
   • Port Security Aging
     • Absolute
       • The secure addresses on the port are deleted after the specified aging time.
     • Inactivity
       • The secure addresses on the port are deleted only if they are inactive for the specified aging time.
   • Port Security Violation Modes
     • If the MAC address of a device attached to the port differs from the list of secure addresses, then a port violation occurs.
       • Switch(config-if)# switchport port-security violation { protect | restrict | shutdown}
   • Port in error-disabled State
     • When a port is shutdown and placed in the error-disabled state, no traffic is sent or received on that port.
   • Verify Port Security
     • Port Security for All Interfaces
       • S1# show port-security
     • Port Security for a Specific Interface
       • S1# show port-security interface fastethernet 0/18
     • Verify Learned MAC Addresses
       • S1# show run | begin interface FastEthernet0/19
     • Verify Secure MAC Addresses
       • S1# show port-security address

2. Mitigate VLAN Attacks

   • VLAN Attacks Review
     • Spoofing DTP messages from the attacking host to cause the switch to enter trunking mode.
     • Introducing a rogue switch and enabling trunking.
     • Another type of VLAN hopping attack is a double-tagging (or double-encapsulated) attack.
   • Steps to Mitigate VLAN Hopping Attacks
     • Step 1: Disable DTP (auto trunking) negotiations on non-trunking ports by using the switchport mode access interface configuration command.
     • Step 2: Disable unused ports and put them in an unused VLAN.
     • Step 3: Manually enable the trunk link on a trunking port by using the switchport mode trunk command.
     • Step 4: Disable DTP (auto trunking) negotiations on trunking ports by using the switchport nonegotiate command.
     • Step 5: Set the native VLAN to a VLAN other than VLAN 1 by using the switchport trunk native vlan vlan_number command.

3. Mitigate DHCP Attacks

   • DHCP Attacks Review
     • The goal of a DHCP starvation attack is to create a Denial of Service (DoS) for connecting clients.
   • DHCP Snooping
     • DHCP snooping does not rely on source MAC addresses. Instead, DHCP snooping determines whether DHCP messages are from an administratively configured trusted or untrusted source.
   • Steps to Implement DHCP Snooping
     • Step 1. Enable DHCP snooping by using the ip dhcp snooping global configuration command.
     • Step 2. On trusted ports, use the ip dhcp snooping trust interface configuration command.
     • Step 3: Limit the number of DHCP discovery messages that can be received per second on untrusted ports by using the ip dhcp snooping limit rate interface configuration command.
     • Step 4. Enable DHCP snooping by VLAN, or by a range of VLANs, by using the ip dhcp snooping vlan global configuration command.

4. Mitigate ARP Attacks

   • Dynamic ARP Inspection
     • To prevent ARP spoofing and the resulting ARP poisoning, a switch must ensure that only valid ARP Requests and Replies are relayed.
   • DAI Implementation Guidelines
     • To mitigate the chances of ARP spoofing and ARP poisoning, follow these DAI implementation guidelines:
       • Enable DHCP snooping globally.
       • Enable DHCP snooping on selected VLANs.
       • Enable DAI on selected VLANs.
       • Configure trusted interfaces for DHCP snooping and ARP inspection.

5. Mitigate STP Attacks

   • PortFast and BPDU Guard
     • To mitigate Spanning Tree Protocol (STP) manipulation attacks, use PortFast and Bridge Protocol Data Unit (BPDU) Guard
       • PortFast
       • BPDU Guard
   • Configure PortFast
     • PortFast can be enabled on an interface by using the spanning-tree portfast interface configuration command.
       • Portfast can be configured globally on all access ports by using the spanning-tree portfast default global configuration command.
   • Configure BPDU Guard
     • BPDU Guard can be enabled on a port by using the spanning-tree bpduguard enable interface configuration command.
       • Use the spanning-tree portfast bpduguard default global configuration command to globally enable BPDU guard on all PortFast-enabled ports.