CCNA 2 - Capitulo 11.3

CCNA 2 - Capitulo 11.3

1. SWITCHING SECURITY CONFIGURATION

   • MITIGATION ATTACKS
     • MITIGATE ARP ATTACKS
       • HOW TO MITIGATE ?
         • (DAI) DYNAMIC ARP INSPECTION REQUIRES
           • DHCP SNOOPING ENABLE
           • GUIDELINES MITIGATE ARP SPOOFING AND POISONING
             • CONFIGURE TRUST INTERFACES FOR
               • DHCP SNOOPING AND ARP INSPECTION
             • REQUIREMENTS
               • ENABLE
                 • DHCP SNOOPING GLOBALLY
                   • DHCP SNOOPING ENABLED BECAUSE BINDING TABLE TO OPERATE
                 • DHCP SNOOPING ON SELECT VLANS
                 • DAI ON SELECT VLANS
               • CAN ALSO BE CONFIGURED TO CHECK SOURCE MAC AND IP
                 • SOURCE MAC - CHECKS THE SOURCE MAC ADDRESS IN THE ETHERNET HEADER
                   • AGAINST THE SENDER MAC ADDRESS IN THE ARP BODY.
                 • CHECKS THE DESTINATION MAC ADDRESS IN THE ETHERNET HEADER
                   • AGAINST THE TARGET MAC ADDRESS IN ARP BODY.
                 • IP ADDRESS - CHECKS THE ARP BODY FOR INVALID AND UNEXPECTED IP ADDRESSES
                   • INCLUDING ADDRESSES 0.0.0.0, 255.255.255.255, AND ALL IP MULTICAST ADDRESSES.
                 • S1(CONFIG)#IP ARP INSPECTION VALIDATE | SRC-MAC | DST-MAC
                   • CONFIGURE DAI TO DROP WHEN IP ADDRESS ARE INVALID
                   • CAN BE USED WHEN MAC BODY ARP DO NOT MATCH SPECIFIED ETHENET HEADER
           • AND PREVENTS
             • PREVENT ARP ATTACKS BY
               • NOT RELAYING
                 • INVALID REQUEST
                 • GRATUITOUS REQUESTS
               • INTERCEPTING ALL ARP REQUEST AND REPLIES
                 • UNTRUSTED PORTS
               • VERIFY EACH INTERCEPTED
                 • UNTRUSTED PORTS
               • ARP PACKETS IS EXCEEDED
                 • ERRO DISABLING THE INTERFACE
               • DROPPING AND LOGGING ARP REQUESTS COMIMG
                 • INVALID SOURCES
             • ARP ATTACKS
               • DAI CONFIGURATION EXAMPLE
                 • S1(CONFIG-IF)#IP ARP INSPECTION TRUST
                   • PORT TRUNKS
                 • S1(CONFIG)#IP ARP INSPECTION VLAN 10 , 20 ,30
       • THREAT ACTOR SEND UNSOLICITED ARP REQUESTS OTHER HOSTS
     • MITIGATE STP ATTACKS
       • ATTACK PURPOSE
         • CHANGING TOPOLOGY OF A NETWORK
         • SPOOFING ROOT BRIDGE
       • HOW TO MITIGATE ?
         • PORTFAST
           • CONFIGURE PORTFAST
             • ENABLE INTERFACE
               • S1(CONFIG)#SPANNING-TREE PORTFAST
             • GLOBALLY
               • VERIFY PORTFAST IS ENABLED GLOBALLY ?
                 • S1#SHOW RUNNING-CONFIG | BEGIN SPAN
                 • S1#SHOW SPANNING-TREE SUMMARY
                 • S1#SHOW RUNNING-CONFIG INTERFACE TYPE/NUMBER COMMAND
               • HOW CONFIGURE ?
                 • S1(CONFIG)#SPANNING-TREE PORTFAST DEFAULT
           • BRINGS AN INTERFACES ACCESS OR TRUNK TO THE FORWADING FROM A BLOCKING
             • BYPASSING LISTING AND LEARNING STATE
           • MINIMIZE THE TIME THAT ACCESS OIRTS WAIT FOR STP TO CONVERGE
         • BPDU GUARD
           • DISABLE IMMEDIATLY IF
             • PORT THAT RECEIVES BPDU
           • HOW RECOVERED PORT ?
             • S1(CONFIG)#ERRDISABLE RECOVERY CAUSE BPDUGUARD
           • ONLY END DEVICES
           • CONFIGURE BPDU GUARD
             • ENABLE INTERFACE
               • S1(CONFIG)#SPANNING-TREE BPDUGUARD ENABLE
             • GLOBALLY
               • S1(CONFIG)#SPANNING-TREE PORTFAST BPDUGUARD DEFAULT
           • UNEXPECTED BPDU ?
             • UNAUTHORIZED ATTEMP TO ADD A SWITCH TO THE NETWORK
           • IF ANY BPDUs RECEIVED ON BPDU GUARD ENABLED PORT ?
             • PORT IS PUT INTO ERROR DISABLED PORT
           • DISPLAY INFORMATION STATE SPANNING TREE ?