CCNA Module 11 — Network Security

11.1 — Switch Port Security

11.1.1 Secure Unused Ports

Main idea: Disable switch ports that are not being used to prevent unauthorized devices from connecting.

• Layer 2 devices are a common weak point in network security.

• All switch ports should be secured before the switch is deployed.

• Use shutdown to disable a port.

• Use no shutdown to reactivate a port.

• Use interface range to configure multiple ports at once.

Example: Disable ports Fa0/8 through Fa0/24

S1(config)# interface range fa0/8 - 24
S1(config-if-range)# shutdown

Exam tip: An unused port should generally be disabled rather than left active.

11.1.2 Mitigate MAC Address Table Attacks

Main idea: Use port security to limit the MAC addresses a switch can learn on a port.

• A MAC address table overflow attack floods a switch with fake source MAC addresses.

• The switch's MAC address table can fill up, causing it to flood unknown unicast frames throughout the same VLAN.

• This may allow an attacker to see traffic not normally directed to their device.

• Port security limits the number of permitted MAC addresses on a switch port.

Remember: Port security is the simplest and most effective method described in the module for preventing MAC address table overflow attacks.

11.1.3 Enable Port Security

Port security must be configured on a manually configured access port or trunk port.

A switch port using dynamic auto mode may reject the port security command. Configure the port as an access port first.

Example:

S1(config)# interface fa0/1
S1(config-if)# switchport mode access
S1(config-if)# switchport port-security

Useful verification command:

S1# show port-security interface fa0/1

Important output fields:

• Port Security: Whether port security is enabled.

• Port Status: Whether the secure port is up, down, or shut down due to a violation.

• Violation Mode: What the switch does when a violation occurs.

• Maximum MAC Addresses: How many secure MAC addresses are allowed.

• Security Violation Count: Number of recorded violations.

11.1.4 Limit and Learn MAC Addresses

The default maximum number of secure MAC addresses per port is 1.

To change the limit:

S1(config-if)# switchport port-security maximum 2

The module describes three ways to specify secure MAC addresses:

Static MAC example:

S1(config-if)# switchport port-security mac-address aaaa.bbbb.1234

Sticky MAC example:

S1(config-if)# switchport port-security mac-address sticky

Important distinction: Dynamically learned addresses are not automatically preserved in the startup configuration. Sticky addresses can be saved by saving the running configuration.

11.1.5 Port Security Aging

Aging removes secure MAC addresses after a specified period.

Example: Set a 10-minute inactivity timer.

S1(config-if)# switchport port-security aging time 10
S1(config-if)# switchport port-security aging type inactivity

Exam trap: Absolute aging is based on elapsed time. Inactivity aging depends on whether the address has sent traffic.

11.1.6 Port Security Violation Modes

A violation occurs when a port receives traffic from a source MAC address that is not permitted by its security configuration.

There are three violation modes:

• Protect: Drops traffic from unknown source MAC addresses without sending a syslog message or incrementing the violation counter.

• Restrict: Drops offending traffic, sends a syslog message, and increments the violation counter.

• Shutdown: The default mode. Places the port in the error-disabled state, sends a syslog message, and increments the counter.

Memory trick:

• Protect: Quietly protects.

• Restrict: Rejects and reports.

• Shutdown: Rejects, reports, and shuts down.

11.1.7 Ports in the Error-Disabled State

When a port security violation triggers shutdown mode:

• The port enters the error-disabled state.

• It stops sending and receiving traffic.

• The port LED turns off.

• The violation counter increases.

Before re-enabling the port, investigate the cause and remove any unauthorized device.

To manually reactivate the port:

S1(config)# interface fa0/1
S1(config-if)# shutdown
S1(config-if)# no shutdown

Exam tip: Do not immediately re-enable a port without investigating the security violation.

11.1.8 Verify Port Security

Know these commands:

The goal is to confirm that port security is enabled, the MAC address limit is correct, the intended violation mode is configured, and secure MAC addresses are correct.

These sections follow the module's explanations and Cisco configuration examples. Pasted markdown Pasted markdown Pasted markdown Pasted markdown

11.2 — Mitigate VLAN Hopping Attacks

What is VLAN hopping?

A VLAN hopping attack attempts to gain access to traffic on another VLAN.

The module focuses on preventing unauthorized trunk negotiation and reducing exposure from unused ports.

Five steps to prevent VLAN hopping

1. Disable automatic trunking on access ports by configuring switchport mode access.

2. Disable unused ports and assign them to an unused VLAN.

3. Manually configure trunk ports using switchport mode trunk.

4. Disable DTP negotiation on trunk ports using switchport nonegotiate.

5. Change the native VLAN from the default VLAN 1 to an unused VLAN.

Important commands

Configure access ports:

S1(config)# interface range fa0/1 - 16
S1(config-if-range)# switchport mode access

Disable unused ports and assign them to VLAN 1000:

S1(config)# interface range fa0/17 - 20
S1(config-if-range)# switchport mode access
S1(config-if-range)# switchport access vlan 1000
S1(config-if-range)# shutdown

Configure trunk ports securely:

S1(config)# interface range fa0/21 - 24
S1(config-if-range)# switchport mode trunk
S1(config-if-range)# switchport nonegotiate
S1(config-if-range)# switchport trunk native vlan 999

Exam traps:

• switchport mode access prevents the port from negotiating a trunk.

• switchport mode trunk manually configures a trunk.

• switchport nonegotiate disables DTP negotiation.

• The example uses VLAN 999 as the native VLAN and VLAN 1000 for unused access ports. These are example choices, not universal requirements.

Pasted markdown

11.3 — DHCP Attacks and DHCP Snooping

11.3.1 DHCP Attack Review

Know the difference between these attacks:

DHCP starvation mitigation: Port security can help because attack tools may generate requests with many different source MAC addresses.

DHCP spoofing mitigation: Use DHCP snooping to control which switch ports may receive DHCP server messages.

Important distinction: Port security alone may not stop DHCP spoofing if the attacker uses a legitimate Ethernet source MAC address while placing a different address in the DHCP message.

11.3.2 DHCP Snooping

DHCP snooping filters DHCP messages based on whether the switch interface is trusted or untrusted.

• Trusted ports: Ports connected to legitimate infrastructure, such as a DHCP server.

• Untrusted ports: Generally access ports connected to end devices.

• All interfaces are untrusted by default.

• Trusted interfaces must be explicitly configured.

• DHCP snooping can rate-limit DHCP traffic from untrusted ports.

DHCP snooping also builds a binding table that associates a client's MAC address with its assigned IP address.

11.3.3 Steps to Implement DHCP Snooping

1. Enable DHCP snooping globally.

2. Mark the legitimate DHCP server-facing interface as trusted.

3. Set a DHCP message rate limit on untrusted interfaces.

4. Enable DHCP snooping for the required VLANs.

11.3.4 Configuration Example

Enable DHCP snooping:

S1(config)# ip dhcp snooping

Trust the interface connected to the DHCP server:

S1(config)# interface f0/1
S1(config-if)# ip dhcp snooping trust

Limit DHCP traffic on access ports:

S1(config)# interface range f0/5 - 24
S1(config-if-range)# ip dhcp snooping limit rate 6

Enable DHCP snooping for selected VLANs:

S1(config)# ip dhcp snooping vlan 5,10,50-52

Verification commands

Exam trap: The legitimate DHCP server-facing port should be trusted. Ordinary client-facing access ports should generally remain untrusted.

Pasted markdown

11.4 — Dynamic ARP Inspection (DAI)

11.4.1 What is DAI?

Dynamic ARP Inspection (DAI) helps prevent ARP spoofing and ARP poisoning.

In an ARP spoofing attack, an attacker sends deceptive ARP messages to make other devices associate an IP address—such as the default gateway's address—with the attacker's MAC address.

DAI helps defend the network by:

• Intercepting ARP requests and replies on untrusted ports.

• Checking intercepted packets against valid IP-to-MAC bindings.

• Dropping and logging invalid ARP traffic.

• Preventing invalid ARP information from being forwarded.

• Potentially error-disabling an interface if its configured ARP packet threshold is exceeded.

Critical fact: DAI requires DHCP snooping because it uses the DHCP snooping binding table to validate IP-to-MAC associations.

11.4.2 DAI Implementation Guidelines

Follow this general order:

1. Enable DHCP snooping globally.

2. Enable DHCP snooping on selected VLANs.

3. Enable DAI on selected VLANs.

4. Configure trusted interfaces for DHCP snooping and ARP inspection.

Generally:

• Client-facing access ports are untrusted.

• Appropriate uplinks or infrastructure-facing ports are configured as trusted, according to the network design.

11.4.3 DAI Configuration Example

Enable DHCP snooping and DAI for VLAN 10:

S1(config)# ip dhcp snooping
S1(config)# ip dhcp snooping vlan 10
S1(config)# ip arp inspection vlan 10

Trust the interface connected to the router:

S1(config)# interface fa0/24
S1(config-if)# ip dhcp snooping trust
S1(config-if)# ip arp inspection trust

DAI validation checks

DAI can validate several address fields:

Command:

S1(config)# ip arp inspection validate src-mac dst-mac ip

Exam trap: If you enter multiple ip arp inspection validate commands separately, each new command replaces the previous validation setting. Put all required checks on the same command line.

Pasted markdown

11.5 — STP Attacks: PortFast and BPDU Guard

11.5.1 PortFast and BPDU Guard

Attackers may manipulate the Spanning Tree Protocol (STP) by sending BPDUs that attempt to influence which switch becomes the root bridge or alter the network topology.

Two important protections are PortFast and BPDU Guard.

PortFast

• Moves an access port to the forwarding state without waiting through the normal STP listening and learning states.

• Helps end devices connect to the network faster.

• Should be used on ports connected to end devices, not switch-to-switch links.

• Enabling PortFast on a port connected to another switch can create a spanning-tree loop.

BPDU Guard

• Protects PortFast-enabled edge ports from unexpected BPDUs.

• If a BPDU arrives on a BPDU Guard-enabled port, the port enters the error-disabled state.

• The port must be manually re-enabled or recovered through an appropriate error-disable recovery configuration.

Memory trick: PortFast speeds up end-device ports; BPDU Guard shuts down a protected port that receives a BPDU.

11.5.2 Configure PortFast

Enable PortFast on one access port:

S1(config)# interface fa0/1
S1(config-if)# switchport mode access
S1(config-if)# spanning-tree portfast

Enable PortFast by default on access ports:

S1(config)# spanning-tree portfast default

Verification commands:

S1# show spanning-tree summary
S1# show running-config interface fa0/1
S1# show spanning-tree interface fa0/1 detail

Exam trap: PortFast should only be enabled on ports connected to end devices. A switch connected to a PortFast-enabled port can introduce a loop.

11.5.3 Configure BPDU Guard

Enable BPDU Guard on an individual interface:

S1(config)# interface fa0/1
S1(config-if)# spanning-tree bpduguard enable

Enable BPDU Guard by default on PortFast-enabled ports:

S1(config)# spanning-tree portfast bpduguard default

Verify the configuration:

S1# show spanning-tree summary

Best practice from the module: Enable BPDU Guard on all PortFast-enabled ports.

Pasted markdown

Final Exam Review — Must-Know Facts