Cap6. Securing the Local Area Network

Cap6. Securing the Local Area Network

1. Internal LANs consists of: – Endpoints – Non-endpoint LAN devices – LAN infrastructure

   • Securing Endpoint Devices: A LAN connects many network endpoint devices that act as a network clients
   • Securing Non-Endpoint Devices: A LAN also requires many intermediary devices to in terconnect endpoint devices.
   • Securing the LAN Infrastructure: A network must also be able to mitigate specific LAN attacks

2. Network Admission Control

   • NAC Framework
     • The NAC framework uses the existing Cisco network infrastructure and third-party software to enforce security policy compliance on all endpoints.
   • NAC Appliance
     • The Cisco NAC Appliance is a turnkey solution that condenses the four NAC functions into one appliance.

3. Layer 2 Security

   • Types of Attacks: MAC address spoofing • MAC address table overflows • STP manipulation • LAN storms • VLAN attacks

4. Mitigating STP Manipulation

   • PortFast: Causes a Layer 2 interface to transition from the blocking to the forwarding state immediately, bypassing the listeni ng and learning states.
   • BPDU Guard: The feature keeps the active network topology predictable: – It protects a switched network from receiving BPDUs on port s that should not be receiving them. – Received BPDUs might be accidental or part of an attack.
   • Root guard: enforces the placement of root bridges by limiting the switch ports out of which the root bridge can be ne gotiated.

5. Storm Control

6. Layer 2 Best Practices

   • • Manage switches in secure a manner. • Set all user ports to non-trunking ports. • Use port security where possible for access ports. • Use CDP only where necessary – with phones it is use ful. • Configure PortFast on all non-trunking ports. • Configure BPDU guard on all non-trunking ports. • Configure root guard on STP root ports.

7. Securing Wireless

8. VolP Networks

9. SAN Networks

Imagens e arquivos do mapa