Technical Manual

ManualsBrandsCisco ManualsSwitchesCisco Catalyst 3560E-12SD-E Switch

Layer 2 Security Features on Cisco Catalyst Layer

3 Fixed Configuration Switches Configuration

Example

Document ID: 72846

Contents

Introduction

Prerequisites

Requirements

Components Used

Summary of content (11 pages)

PAGE 1
Layer 2 Security Features on Cisco Catalyst Layer 3 Fixed Configuration Switches Configuration Example Document ID: 72846 Contents Introduction Prerequisites Requirements Components Used Related Products Conventions Background Information Configure Network Diagram Port Security DHCP Snooping Dynamic ARP Inspection IP Source Guard Verify Troubleshoot Related Information Introduction This document provides a sample configuration for some of the Layer 2 security features, such as port security, DHCP snooping
PAGE 2
• Cisco Catalyst 3550 Series Switches • Cisco Catalyst 3560 Series Switches • Cisco Catalyst 3560−E Series Switches • Cisco Catalyst 3750−E Series Switches Conventions Refer to Cisco Technical Tips Conventions for more information on document conventions. Background Information Similar to routers, both Layer 2 and Layer 3 switches have their own sets of network security requirements. Switches are susceptible to many of the same Layer 3 attacks as routers.
PAGE 3
of another host with a particular IP address, and an ARP response comes from the host whose address matches the request. The requesting host then caches this ARP response. Within the ARP protocol, another provision is made for hosts to perform unsolicited ARP replies. The unsolicited ARP replies are called Gratuitous ARP (GARP). GARP can be exploited maliciously by an attacker to spoof the identity of an IP address on a LAN segment.
PAGE 4
Additional features in the Catalyst family of switches, such as the DHCP snooping, can be used to help guard against a DHCP starvation attack. DHCP snooping is a security feature that filters untrusted DHCP messages and builds and maintains a DHCP snooping binding table. The binding table contains information such as the MAC address, IP address, lease time, binding type, VLAN number and the interface information that corresponds to the local untrusted interfaces of a switch.
PAGE 5
Port Security You can use the port security feature to limit and identify MAC addresses of the stations allowed to access the port. This restricts input to an interface. When you assign secure MAC addresses to a secure port, the port does not forward packets with source addresses outside the group of defined addresses. If you limit the number of secure MAC addresses to one and assign a single secure MAC address, the workstation attached to that port is assured the full bandwidth of the port.
PAGE 6
!−−− Default port security configuration on the switch. Cat3750#conf t Enter configuration commands, one per line. End with CNTL/Z. Cat3750(config)#interface fastEthernet 1/0/2 Cat3750(config−if)#switchport port−security Command rejected: FastEthernet1/0/2 is a dynamic port. !−−− Port security can only be configured on static access ports or trunk ports. Cat3750(config−if)#switchport mode access !−−− Sets the interface switchport mode as access.
PAGE 7
Configured MAC Addresses Sticky MAC Addresses Last Source Address:Vlan Security Violation Count : : : : 1 0 0011.8565.4B75:1 1 Note: Same MAC addresses should not be configured as secure and static MAC address on different ports of a switch. When an IP phone is connected to a switch through the switchport configured for voice VLAN, the phone sends untagged CDP packets and tagged voice CDP packets. So the MAC address of the IP phone is learned on both the PVID and the VVID.
PAGE 8
Rogue DHCP servers can be mitigated by DHCP snooping features. The ip dhcp snooping command is issued in order to enable DHCP globally on the switch. When configured with DHCP snooping, all ports in the VLAN are untrusted for DHCP replies. Here, only the FastEthernet interface 1/0/3 connected to the DHCP server is configured as trusted. DHCP Snooping Cat3750#conf t Enter configuration commands, one per line. Cat3750(config)#ip dhcp snooping End with CNTL/Z. !−−− Enables DHCP snooping on the switch.
PAGE 9
certain man−in−the−middle attacks. Dynamic ARP inspection ensures that only valid ARP requests and responses are relayed.
PAGE 10
!−−− Verifies the dynamic ARP inspection configuration. Cat3750# Refer to Configuring Dynamic ARP Inspection for more information. IP Source Guard IP source guard is a security feature that filters traffic based on the DHCP snooping binding database and on manually configured IP source bindings in order to restrict IP traffic on non−routed Layer 2 interfaces. You can use IP source guard to prevent traffic attacks caused when a host tries to use the IP address of its neighbor.
PAGE 11
Fa1/0/1 ip active 10.0.0.2 1 !−−− For VLAN 1, IP source guard with IP address filtering is configured !−−− on the interface and a binding exists on the interface. Cat3750# Refer to Understanding IP Source Guard for more information. Verify There is currently no verification procedure available for this configuration. Troubleshoot There is currently no specific troubleshooting information available for this configuration.