Week 4-5

RADIUS

An open-standard AAA protocol that combines authentication and authorization into one single process and encrypts only the password field.

TACACS+

A Cisco-proprietary AAA protocol that completely separates authentication, authorization, and accounting, and encrypts the entire body of the packet.

Sticky MAC Addresses

A port security feature that dynamically learns MAC addresses and saves them to the running configuration so they persist across reboots.

Protect Violation Mode

A port security mode that drops packets from unauthorized MAC addresses but does not shut down the port or increment the security violation counter.

Restrict Violation Mode

A port security mode that drops unauthorized traffic, increments the security violation counter, and sends a syslog message without disabling the port.

Shutdown Violation Mode

The default port security action that immediately places a port into the err-disabled state and sends an alert when an unauthorized MAC is detected.

Native VLAN Mismatch Attack

A structural vulnerability where an attacker sends double-tagged traffic over a native VLAN to sneak packets across a trunk line without a router.

Dynamic Trunking Protocol (DTP)

A Cisco-proprietary protocol used to automatically negotiate trunking links, which security best practices dictate should be disabled on access ports.

Untrusted Ports

Switch interfaces configured during DHCP Snooping that are exposed to general user hosts and are forbidden from sending DHCP server response messages.

DHCP Snooping Binding Table

A dynamic database created by the switch that logs the MAC address, IP address, lease time, and interface port of trusted client devices.

Gratuitous ARP

A type of unprompted ARP response message used by devices to announce their IP-to-MAC mapping, often abused by hackers during ARP spoofing attacks.

Trusted Ports (DAI)

Switch interfaces configured during Dynamic ARP Inspection that bypass valid address validation checks because they connect to other switches or routers.

PortFast

An STP optimization feature that immediately moves an access port from a blocking state to a forwarding state, bypassing the listening and learning states.

Virtual MAC Address

A shared identifier used by First Hop Redundancy Protocols (FHRP) to ensure local client traffic can seamlessly redirect to a backup router.

HSRP Priority

A configurable numerical value (0 to 255, default 100) used by Hot Standby Router Protocol to determine which physical router becomes the Active gateway.

HSRP Initial State

The beginning state of an HSRP router, indicating that the protocol has just started up and the configuration is not yet functional.

HSRP Listen State

An HSRP phase where the router knows the virtual IP address but is actively listening to determine who the current Active and Standby routers are.

HSRP Speak State

An HSRP phase where the router actively transmits hello messages to participate in the election of the Active and Standby default gateways.

Bridge Protocol Data Unit (BPDU)

Frame messages exchanged between switches every two seconds to share parameters and calculate the loop-free Spanning Tree topology.

Bridge ID (BID)

An 8-byte value composed of a 2-byte Bridge Priority and a 6-byte MAC address, used by STP to elect the central Root Bridge.

System ID Extension

A 12-bit modifier added to the STP Bridge Priority that allows the switch to run unique Spanning Tree instances for separate VLANs (PVST+).

Max Age

The Spanning Tree timer (default 20 seconds) that dictates how long a switch will store BPDU parameters before discarding them if a link drops.

Forward Delay

The amount of time (default 15 seconds) an STP port spends listening and learning before transitioning into a packet-forwarding state.

Port-Channel

The logical interface created when bundle aggregation technologies unite multiple physical wires together into one virtual connection.

Desirable Mode (PAgP)

An EtherChannel negotiation state where an interface actively sends PAgP packets to initiate and build a port bundle with a remote switch.

Active Mode (LACP)

An open-standard EtherChannel negotiation state where an interface actively transmits LACP packets to establish a trunk bundle link.