CCNA 2 - Capitulo 11.2

CCNA 2 - Capitulo 11.2

1. SWITCHING SECURITY CONFIGURATION

   • MITIGATION ATTACKS
     • MITIGATE DHCP ATTACKS
       • GOAL OF A DHCP ?
         • CREATE DDOS FOR CONNECTING CLIENTS
       • TYPES ATTACKS
         • DHCP SPOOFING
           • DHCP SNOOPING (TRACKING )
             • STEPS TO IMPLEMENT
               • 1 ) ENABLE DHCP SNOOPING
                 • S1(CONFIG)#IP DHCP SNOOPING
               • 2) ON TRUSTED PORTS
                 • S1(CONFIG-IF )#IP DHCP SNOOPING TRUST
               • 3) LIMIT NUMBER DHCP DISCOVERY UNTRUSTED PORTS
                 • S1(CONFIG-IF )#IP DHCP SNOOPING LIMIT RATE 6
               • 4) ENABLE DHCP SNOOPING BY VLAN
                 • S1(CONFIG)# IP DHCP SNOOPING VLAN 5,10,50
             • TRUST PORT
               • WHERE ARE THEY USED?
                 • DEVICES UNDER YOUR ADMINISTRATIVE CONTROLE SUCH
                   • SWITCH , ROUTER , SERVER
                 • PORT TRUNK
                 • DIRECTLY CONNECTED DHCP SERVER
             • UNTRUSTED PORT
               • WHERE ARE THEY USED?
                 • DEVICE BEYONDE FIREWALL OR OUTSIDE NETWORKS
                 • ACCESS PORTS
               • DHCP SNOOPING BINDING TABLE
                 • SOURCE MAC OF DEVICE ON AN UNTRUSTED AND THE IP ASSIGNED BY THE DHCP SERVER
             • DOES NOT RELY ON SOURCE MAC BUT TRUST OR UNTRUSTED
             • COMMANDS
               • S1#SHOW IP DHCP SNOOPING
                 • VERIFY DHCP SNOOPING
               • S1#SHOW IP DHCP BINDING
                 • VIEW THE CLIENTS THAT HAVE RECEIVED DHCP INFORMATION
           • HOW TO MITIGATE ?
             • DHCP SNOOPING AND TRUST PORTS
         • DHCP STARVATION
           • HOW TO MITIGATE ?
             • PORT SECURITY
       • ATTACK TOOL - GLOBBER
         • USES A UNIQUE SOURCE MAC FOR EACH DHC REQUEST SENT
     • ATTACK SALT VLAN
       • HOW CAN IT BE STARTED?
         • SPOOFING DTP MESSAGES
           • ATTACKING HOST TO CAUSES THE SWITCH ENTER TRUNKING MODE
             • SEND TRAFIC TAGGED WITH THE TARGET VLAN
         • ROUGUE SWITCH AND ENABLE TRUNKING
           • ATTACKER THEN ACCESS ALL THE VLANs
         • DOUBLE TAGGING
           • ADVANTAGE HARDWARE ON MOST SWITCH OPERATE
       • STEPS TO MITIGATE VLAN HOOPING ATTACKS
         • 1) DISABLE DTP (AUTO TRUNKING) ON NON TRUNKS PORTS
           • S1(CONFIG-IF)#SWITCHPORT MODE ACCESS
         • 2- DISABLE UNSED PORTS
           • PUT THEM UNSED VLAN
         • 3- MANUALLY ENABLE TRUNK LINK ON TRUNK PORT
           • S1(CONFIG-IF)#SWITCHPORT MODE TRUNK
         • 4) DISABLE DTP NEGOTIATIONS ON TRUNKING PORTS
           • S1(CONFIG-IF)# SWITCHPORT NONEGOTIATE
         • 5) SET NATIVE VLAN TO A VLAN OTHER THAN 1
           • S1(CONFIG-IF)# SWITCHPORT TRUNK NATIVE VLAN 99