Layer 2 Security Controls and Common Attacks

The access-layer switch is where end users — and attackers — plug in. Because a switch trusts whatever MAC, DHCP reply, or ARP it hears by default, the access port is the softest target in the network. Access-layer security is easiest to hold as attack-and-mitigation pairs.

Two knobs shape port security. Maximum sets how many source MACs the port accepts — the default is 1, and a phone-plus-PC port needs 2. Sticky learning writes the live MAC into the running-config so you do not type addresses by hand, but you must copy run start or a reload loses it.

Recovering an err-disabled port is a manual shutdown then no shutdown after removing the offending device — a plain no shutdown alone does not clear err-disabled. You can also arm auto-recovery with errdisable recovery cause psecure-violation and an interval.

A rogue DHCP server on a user VLAN can answer a client's DISCOVER faster than the real server and hand out the attacker's box as the default gateway. DHCP snooping classifies every port as trusted or untrusted.

• Trusted ports are the uplinks toward the legitimate DHCP server or other switches — server messages such as OFFER and ACK are allowed to enter here.
• Untrusted ports are end-user access ports, where DHCP server messages are dropped. A client on an untrusted port may still send DISCOVER and REQUEST; it simply cannot masquerade as a server.
• As snooping watches legitimate leases it builds a binding table of MAC to IP to VLAN to port. Enable it globally and per VLAN, and mark trusted ports consistently on every switch in the path.

Access ports usually run Portfast to skip STP's listening and learning delay, and BPDU Guard is what makes that safe. Apply BPDU Guard to access ports, never to core trunks — a trunk is supposed to carry BPDUs.

SW1(config)# interface FastEthernet0/5
SW1(config-if)# switchport mode access
SW1(config-if)# switchport access vlan 20
SW1(config-if)# switchport port-security
SW1(config-if)# switchport port-security maximum 2
SW1(config-if)# switchport port-security mac-address sticky
SW1(config-if)# switchport port-security violation shutdown

Port Security              : Enabled
Port Status                : Secure-up
Violation Mode             : Shutdown
Maximum MAC Addresses      : 2
Total MAC Addresses        : 1
Configured MAC Addresses   : 0
Sticky MAC Addresses       : 1
Last Source Address:Vlan   : 0025.83ab.cd01:20
Security Violation Count   : 0

• Port Status Secure-up means security is active and the port is forwarding. A violation in shutdown mode would read Secure-shutdown instead.
• Maximum 2 with Total 1 shows headroom for the PC after the phone was learned.
• Sticky MAC Addresses : 1 confirms sticky learning captured an address, and show running-config now carries a matching switchport port-security mac-address sticky line — save it with copy run start.
• Security Violation Count is the counter that climbs under restrict and shutdown when an extra MAC appears, and stays at zero under protect.
• switchport mode access matters: port security is only supported on a static access or voice port, not on a dynamically negotiated one.

• Port security limits source MACs per access port; the defaults are maximum 1 and violation shutdown.
• Sticky learning writes the live MAC into the running-config — copy run start or a reload loses it.
• Violation modes: protect drops silently, restrict drops and logs and counts, shutdown err-disables and is the default.
• Recovering an err-disabled port takes shutdown then no shutdown, after removing the offending device.
• DHCP snooping drops rogue server replies on untrusted ports and builds the binding table; trust the uplinks.
• DAI validates ARP against that binding table, so it requires DHCP snooping on the same VLANs.
• BPDU Guard err-disables a Portfast access port that receives a BPDU and needs manual recovery; Root Guard moves a port to root-inconsistent and recovers by itself once the superior BPDUs stop.