Switch Security Configuration

Switch Security Configuration

1. Implement Port Security

   • Limit and Learn MAC Addresses
   • Port Security Aging
   • Port Security Violation Modes
   • Ports in error-disabled State
   • Verify Port Security
   • Enable Port Security
   • Mitigate MAC Address Table Attacks
   • Secure Unused Ports

2. Mitigate VLAN Attacks

   • Disable DTP using mode access
   • Disable unused ports and VLANs
   • Enable manually trunk link
   • Disable DTP using nonegotiate
   • Set the native VLAN (no VLAN 1)

3. Migrate DHCP Attacks

   • DHCP Snooping
     • Determines whether DHCP messages are from an administratively configured trusted or untrusted source
       • Enable DHCP snooping
       • Configuration trusted ports
       • Limit the number of DHCP discovery messages that can be received per second
       • Enable DHCP snooping by VLAN

4. Mitigate STP Attacks

   • Dynamic ARP Inspection (DAI)
     • Replies out to other ports in the same VLAN
     • Intercepting all ARP Request and Replies on untrusted ports
     • Verifying each intercepted packed for a valid IP
     • Dropping and logging ARP Replies comming from invalid to prevent ARP poisoning
     • Error disabling the interface if the configured DAI number of ARP packets is exceeded
   • DAI Implementation Guidelines
     • Enable DHCP snooping on selected VLANs
     • Enable DAI on selected VLANs
     • Configure trusted interfaces for DHCP snooping and ARP inspection
     • Enable DHCP snooping globally

5. Migrate STP Attacks

   • PortFast
     • Immediately brings an interface configured mode access to the forwarding state
   • BPDU Guard
     • Immediately error disables a port