| 2.5 |  | Securing Switches and LAN Access |
| 2.5.1 |  | Overview |

| LAN security is important. Many access level attacks are initiated on the internal LAN. Focusing on the LAN portion of security provides an added layer of protection. Switches are the first line of defense against LAN-based attacks and must be protected. Furthermore, with the addition of Wireless LANs (WLAN), security is a greater challenge than ever before. Fortunately, there are methods to secure wireless access similar to wired access. There are many models of switches and wireless access devices available from SOHO to the enterprise level .

Most of the secure router configurations discussed in the module are available on IOS based switches, such as configuring passwords, securing line access using SSH, logging, and access-lists. Similar security configurations can be applied on non-IOS switches using set based or menu commands. These commands should be implemented to protect against both internal and external threats. Specific configurations are available to increase security on access layer switches, including the following :

- Port security

- limit the Media Access Control (MAC) addresses
- port-based authentication using 802.1x

- VLANs

- management
- private VLANs (PVLANs)

- Monitoring

- SNMPv3
- Switch Port Analyzer (SPAN)

- Access-lists

- Port ACLs (PACLs)
- Router ACLs (RACLs)
- VLAN ACLs (VACLs)

This section will provide a brief overview of specific switch technologies available to increase security. Students should refer to Cisco online, switch configuration guides, or books on switching for more detailed information.

| Media Activity PhotoZoom: Cisco 2950 Switch In this PhotoZoom, students will view a Cisco 2950 switch.

| Media Activity PhotoZoom: Cisco AP1100 Access Point In this PhotoZoom, students will view an AP1100 access point.

| Media Activity PhotoZoom: Cisco Aironet 1200 Series In this PhotoZoom, students will view an Aironet 1200 series.