Layer 2 security: port security, DHCP snooping, DAI

Why Layer 2 needs its own protection

Firewalls and ACLs usually sit at Layer 3, between networks. But inside one VLAN, devices talk directly through the switch, and the old Layer 2 protocols (Ethernet MAC learning, DHCP, ARP) trust whatever they hear. Someone already plugged into an access port can abuse that trust. Cisco switches have features that remove this blind trust. You configure them on the switch, at the edge, where users connect.

Port security

The threat: a switch learns MAC addresses into a table of limited size. A MAC flooding attack sends frames from thousands of fake MAC addresses until the table is full, and the switch then floods frames out of all ports, where they can be captured. Port security limits how many MAC addresses a port may learn, and optionally which ones. It also stops someone unplugging a desk PC and plugging in their own laptop.

SW1(config)# interface gigabitEthernet1/0/5
SW1(config-if)# switchport mode access
SW1(config-if)# switchport access vlan 10
SW1(config-if)# switchport port-security
SW1(config-if)# switchport port-security maximum 2
SW1(config-if)# switchport port-security mac-address sticky
SW1(config-if)# switchport port-security violation restrict

Port security works only on a port set statically to access or trunk, not one left in a dynamic DTP mode. The default is maximum 1 and violation shutdown. Sticky learning adds the learned MAC addresses to the running configuration, so they survive a reboot once you save the config.

An err-disabled port stays down until an engineer brings it back. Fix the cause first, then enter shutdown and no shutdown on the interface. You can also let the switch recover by itself with errdisable recovery cause psecure-violation and errdisable recovery interval 300 (seconds). Check status with show port-security interface g1/0/5.

DHCP snooping

The threat: a fake (rogue) DHCP server on the LAN answers clients first and hands out its own address as the default gateway or DNS server. Traffic then flows through the attacker, a man-in-the-middle. Sometimes it is not even an attack, just a home Wi-Fi router someone plugged in backwards. DHCP snooping splits ports into trusted and untrusted. Untrusted ports (users) may send DHCP client messages but not server messages (OFFER, ACK); those are dropped. Trusted ports are the uplinks towards the real DHCP server.

SW1(config)# ip dhcp snooping
SW1(config)# ip dhcp snooping vlan 10
SW1(config)# interface gigabitEthernet1/0/48
SW1(config-if)# ip dhcp snooping trust
SW1(config-if)# exit
SW1(config)# interface range gigabitEthernet1/0/1 - 24
SW1(config-if-range)# ip dhcp snooping limit rate 10

Snooping also builds the binding table: for every lease it records the client MAC, IP address, VLAN, port and lease time. See it with show ip dhcp snooping binding. The rate limit stops a DHCP starvation attack, where one port sends floods of requests to use up every address in the pool; a port that goes over the limit is err-disabled.

Dynamic ARP Inspection (DAI)

The threat: ARP poisoning. ARP (Address Resolution Protocol) maps an IP address to a MAC address, and hosts believe any ARP reply they receive. An attacker can send fake replies saying "the gateway IP is at my MAC", and quietly receive everyone's traffic. DAI checks every ARP message on untrusted ports against the DHCP snooping binding table. If the IP and MAC pair is not in the table, the ARP message is dropped and logged.

SW1(config)# ip arp inspection vlan 10
SW1(config)# interface gigabitEthernet1/0/48
SW1(config-if)# ip arp inspection trust

VLAN hopping and how to stop it

VLAN hopping means sending traffic into a VLAN you are not supposed to reach. There are two classic forms. In switch spoofing, a host pretends to be a switch using DTP (Dynamic Trunking Protocol) so the port becomes a trunk carrying all VLANs. In double tagging, a frame carries two 802.1Q tags and abuses the native VLAN (the VLAN sent untagged on a trunk). The prevention is simple configuration:

• Set user ports to switchport mode access, which turns off trunk negotiation.
• On real trunks, use switchport mode trunk with switchport nonegotiate, so DTP is not used at all.
• Change the native VLAN on trunks to an unused VLAN (not VLAN 1 and not a user VLAN), the same on both ends.
• Shut down unused ports and put them in an unused VLAN.

SW1(config)# interface gigabitEthernet1/0/48
SW1(config-if)# switchport mode trunk
SW1(config-if)# switchport nonegotiate
SW1(config-if)# switchport trunk native vlan 999