Specific Layer 2 Mitigation for CCNA Security
With a review of the switching technologies and how they operate now in mind, let’s take a specific look at implementing security features on our switches.
BPDU Guard
When you enable BPDU Guard, a switch port that was forwarding stops and disables the port if a BPDU is seen inbound on the port. A user should never be generating legitimate BPDUs. This configuration, applied to ports that should only be access ports to end stations, helps to prevent another switch (that is sending BPDUs) from being connected to the network. This could prevent manipulation of your current STP topology. Example 9-7 shows the implementation of BPDU Guard.
Example 9-7 Implementing BPDU Guard on a Switch Port
SW2(config-if)# interface fa 0/2
SW2(config-if)# spanning-tree bpduguard enable
! Verify the status of the switchport
SW2# show interface fa0/2 status
Port Name Status Vlan Duplex Speed Type
Fa0/2 connected 10 a-full a-100 10/100BaseTX
SW2#
A port that has been disabled because of a violation shows a status of err-disabled. To bring the interface back up, issue a shutdown and then a no shutdown in interface configuration mode.
You can also configure the switch to automatically bring an interface out of err-disabled state, based on the reason it was placed there and how much time has passed before bringing the interface back up. To enable this for a specific feature, follow Example 9-8.
Example 9-8 Configuring the Switch to Automatically Restore Err-Disabled Ports
SW2(config)# errdisable recovery cause bpduguard
! err-disabled ports will be brought back up after 30 seconds of no bpdu
! violations
SW2(config)# errdisable recovery interval 30
! You can also see the timeouts for the recovery
SW2# show errdisable recovery
ErrDisable Reason Timer Status
----------------- --------------
arp-inspection Disabled
bpduguard Enabled
<snip>
Timer interval: 30 seconds
Interfaces that will be enabled at the next timeout:
SW2#
Root Guard
Your switch might be connected to other switches that you do not manage. If you want to prevent your local switch from learning about a new root switch through one of its local ports, you can configure Root Guard on that port, as shown in Example 9-9. This will also help in preventing tampering of your existing STP topology.
Example 9-9 Controlling Which Ports Face the Root of the Spanning Tree
SW1(config)# interface fa 0/24
SW1(config-if)# spanning-tree guard root
%SPANTREE-2-ROOTGUARD_CONFIG_CHANGE: Root guard enabled on port
FastEthernet0/24.
Port security controls how many MAC addresses can be learned on a single switch port. This feature is implemented on a port-by-port basis. A typical user uses just a single MAC address. Exceptions to this may be a virtual machine or two that might use different MAC addresses than their host, or if there is an IP phone with a built-in switch, which may also account for additional MAC addresses. In any case, to avoid a user connecting dozens of devices to a switch that is then connected to their access port, you can use port security to limit the number of devices (MAC addresses) on each port.
This also protects against malicious applications that may be sending thousands of frames into the network, with a different bogus MAC address for each frame, as the user tries to exhaust the limits of the dynamic MAC address table on the switch, which might cause the switch to forward all frames to all ports within a VLAN so that the attacker can begin to sniff all packets. This is referred to as a CAM table overflow attack. Content-addressable memory (CAM) is a fancy way to refer to the MAC address table on the switch.
Port security also prevents the client from depleting DHCP server resources, which could have been done by sending thousands of DHCP requests, each using a different source MAC address. DHCP spoofing attacks take place when devices purposely attempt to generate enough DHCP requests to exhaust the number of IP addresses allocated to a DHCP pool.
With the port security feature, the default violation action is to shut down the port. Alternatively, we can configure the violation response to be to “protect,” which will not shut down the port but will deny any frames from new MAC addresses over the set limit. The “restrict” action does the same as protect but generates a syslog message, as well.
To implement port security, follow Example 9-10.
Example 9-10 Implementing Port Security
SW2(config-if)# interface fa 0/2
! Enable the feature per interface
SW2(config-if)# switchport port-security
! Set the maximum to desired number. Default is 1. If we administratively
! set the maximum to 1, the command won't show in the running configuration
! because the configuration matches the default value. It is handy to know
! this behavior, so you won't be surprised by what may seem to be a missing
! part of your configuration.
SW2(config-if)# switchport port-security maximum 5
! Set the violation action. Default is err-disable. Protect will simply
! not allow
! frames from MAC addresses above the maximum.
SW2(config-if)# switchport port-security violation protect
! This will cause the dynamic mac addresses to be placed into running
! -config to save them to startup config, use copy run start
SW2(config-if)# switchport port-security mac-address sticky
! To verify settings, use this command
SW2# show port-security
Secure Port MaxSecureAddr CurrentAddr SecurityViolation Security Action
(Count) (Count) (Count)
---------------------------------------------------------------------------
Fa0/2 5 1 0 Protect
---------------------------------------------------------------------------
Total Addresses in System (excluding one mac per port) : 0
Max Addresses limit in System (excluding one mac per port) : 6144
! This can also provide additional information about port security:
SW2# show port-security interface fa0/2
Port Security : Enabled
Port Status : Secure-up
Violation Mode : Protect
Aging Time : 0 mins
Aging Type : Absolute
SecureStatic Address Aging : Disabled
Maximum MAC Addresses : 5
Total MAC Addresses : 1
Configured MAC Addresses : 0
Sticky MAC Addresses : 1
Last Source Address:Vlan : 0000.2222.2222:10
Security Violation Count : 0
For a video demonstration of port security, see the video on that topic that accompanies this book.