Switch Security Configuration

Switch Security Configuration

1. Implement Port Security

   • Secure Unused Ports
     • disable all unused ports on a switch
   • Mitigate MAC Address Table Attacks
     • By limiting the number of permitted MAC addresses on a port to one, port security can be used to control unauthorized access to the network
   • Enable Port Security
     • Note: Trunk port security is beyond the scope of this course.
   • Limit and Learn MAC Addresses
     • 1. Manually Configured
     • 2. Dynamically Learned
     • 3. Dynamically Learned – Sticky
   • Port Security Aging
     • Absolute
     • Inactivity
   • Port Security Violation Modes
     • Switch(config-if)# switchport port-security violation { protect | restrict | shutdown}
   • Ports in error-disabled State
     • No traffic is sent or received on that port

2. Mitigate VLAN Attacks

   • VLAN Attacks Review
     • Spoofing DTP messages from the attacking host to cause the switch to enter trunking mode
     • Introducing a rogue switch and enabling trunking.
     • Double-tagging (or double-encapsulated) attack.
   • Steps to Mitigate VLAN Hopping Attacks
     • Step 1: Disable DTP (auto trunking)
     • Step 2: Disable unused ports
     • Step 3: Manually enable the trunk link on a trunking port
     • Step 4: Disable DTP (auto trunking)
     • Step 5: Set the native VLAN to a VLAN other than VLAN 1

3. Mitigate DHCP Attacks

   • DHCP Attack Review
   • DHCP Snooping
   • Steps to Implement DHCP Snooping
     • Step 1. Enable DHCP snooping by using the ip dhcp snooping global configuration command.
     • Step 2. On trusted ports, use the ip dhcp snooping trust interface configuration command.
     • Step 3: Limit the number of DHCP discovery messages that can be received per second on untrusted ports
     • Step 4. Enable DHCP snooping by VLAN, or by a range of VLANs

4. Mitigate ARP Attacks

   • Dynamic ARP Inspection
     • To prevent ARP spoofing and the resulting ARP poisoning, a switch must ensure that only valid ARP Requests and Replies are relayed.
   • DAI Implementation Guidelines
     • Enable DHCP snooping globally.
     • Enable DHCP snooping on selected VLANs.
     • Enable DAI on selected VLANs.
     • Configure trusted interfaces for DHCP snooping and ARP inspection.
   • DAI Configuration Example

5. Mitigate STP Attacks

   • PortFast and BPDU Guard
     • PortFast
     • BPDU Guard
   • Configure PortFast
     • spanning-tree portfast
   • Configure BPDU Guard
     • spanning-tree bpduguard enable