CCNA 2 - Capitulo 10.2

CCNA 2 - Capitulo 10.2

1. LAYER 2 SECURITY THEATS

   • LAYER 2 IS COMPRIMISED ?
     • ALL THE LAYERS ABOVE IT ARE ALSO AFFECTED
       • EX : THREAT ACTOR WITH ACCESS TO THE INTERNAL NETWORK CAPTURED LAYER 2 FRAMES
   • SWITCH ATTACK CATEGORIES - ATTACKS
     • DHCP ATTACKS
       • DHCP STARVATION
         • WHAT TOOLS WERE USED?
           • GLOBBER TOOLS
             • LOOK AT THE ENTIRE SCOPE OF LEASABLE IP ADDRESSES AND TRIES TO LEASE THEM ALL
               • "CREATES DHCP DISCOVERY MESSAGES WITH BOGUS MAC ADDRESSES"
         • HOW DOES THE ATTACK WORK?
           • CREATE A DoS FOR CONNECTING CLIENTS
       • DHCP SNOOPING
         • HOW DOES THE ATTACK WORK?
           • THREAT ACTOR IMPLEMENTS ROUGUE DHCP SERVER
             • PROVIDES
               • CONFIGURATION PARAMETERS TO LEGITIME CLIENTS
                 • WRONG
                   • DEFAULT GATEWAY
                     • INVALID GATEWAY
                     • CREATE MAN IN THE MIDDLE ATTACK
                   • DNS SERVER
                     • POITING THE USER TO A NEFARIUS WEBSITE
                   • IP ADDRESS
             • IS CONNECTED THE NETWORK
       • MITIGATION TECHNIQUES ?
         • DHCP SNOOPING
         • PORT SECURITY
     • MITIGATION TECHNIQUES THEY WILL NOT BE EFFECTIVE IF ARE USED
       • MANAGEMENT PROTOCOLS SYSLOG , SNMP , TFTP , FTP
     • FOLLOWING STRATEGIES ARE RECOMMENDED
       • ALWAYS SECURE VARIANTS SUCH
         • SSH , SCP , SFTP , SSL / TLS
       • USING OUT-OF-BAND MANAGEMENT TO MANAGE DEVICES
       • DEDICATED MANAGEMENT VLAN TO MANAGE DEVICES
       • ACLs UNWANTED ACCESS
   • FOCOUSING ON THE FRAME FOUND IN THE DATA LINK LAYER 2
   • SWITCH ATTACK CATEGORIES - ATTACKS
     • VLAN ATTACKS
       • VLAN HOPPING
         • VLAN TO BE SEEN BY ANOTHER VLAN WITHOUT ROUTER
         • HOW THE ATTACK WORKS ?
           • THREAT ACTOR CONFIGURES
             • HOST TO ACT LIKE A SWITCH TO ADVANTAGE OF THE
               • DYNAMIC TRUNKING PROTOCOL (DTP)
                 • THREAT ACTOR SIGNALING TO TRUNK WITH THE CONNECTING SWITCH
         • MITIGATION TECHNIQUES ?
           • DISABLE
             • DYNAMIC AUTO IN ACCESS PORT
               • MUST BE CONFIGURE SWITCHPORT SUCH MODE ACCESS (PERMANENT)
             • AUTO TRUNKING ON TRUNK LINKS
               • MUST BE CONFIGURE SWITCHPORT SUCH MODE TRUNK (PERMANENT)
       • DUPLAN VLAN TAGGING
         • "INSIDE (HIDDEN) 802.1Q THE FRAME THAT ALREADY HAS 802.1Q"
         • MITIGATION TECHNIQUES ?
           • NATIVE VLAN IS ONLY USED FOR TRUNK LINKS
         • HOW THE ATTACK WORKS ?
           • 1.THREAT ACTOR SENDS DOUBLE TAGGED 802.1Q
             • OUTER HEADER HAS THE VLAN TAG OF THE THREAT ACTOR
             • WHICH IS THE SAME AS THE NATIVE VLAN OF THE TRUNK PORT
           • 2) DOUBLE-TAGGED FRAME PASSES THE FIRST SWITCH VIA THE NATIVE VLAN.
           • 3.THE SECOND SWITCH READS THE INNER TAG AND FORWARDS IT INTO THE TARGET VLAN.
         • IS UNIDIRECTIONAL ANS WORKS ONLY ATTACKER IS CONNECTED
           • SAME VLAN AS THE NATIVE VLAN OF THE TRUNK PORT
     • MAC TABLE ATTACKS
       • MAC TABLE FLOODING
         • HOW DOES THE ATTACK WORK?
           • ALLOWS A THREAT ACTOR TO CAPTURE ALL OF THE FRAMES SENT FROM ONE HOST TO ANOTHER ON THE LOCAL LAN OR LOCAL VLAN.
           • 4.THE THREAT ACTOR CAN ONLY CAPTURE TRAFFIC WITHIN THE LOCAL LAN OR VLAN
           • 1.ALL MAC TABLE HAVE A FIXED SIZED , THEN RESOURCES STORE MAC ARE LIMITED
           • 2. MAC FLOODING ATTACKS TAKE ADVANTAGE OF THIS LIMITATING BOMBARDING SWITCH ULTIL TABLE IS FULL
           • 3. WHEN THIS OCCOURS , THE SWITCH THREATS FRAME AS UNKNOW AND BEGINS TO FLOOD ALL INCOMING TRAFFIC OUT ALL PORTS
         • WHAT TOOLS WERE USED?
           • MACOF TOOLS
         • OBS : AFFECT OTHER CONNECTED LAYER 2 SWITCHES
       • MITIGATION TECHNIQUES ?
         • PORT SECURITY

2. LAN SECURITY CONCEPTS