| 2.5 |  | Securing Switches and LAN Access |
| 2.5.2 |  | Layer 2 attacks and mitigation |

| What's significant about Layer 2? As the data link layer in the OSI Model, it's one of seven layers designed to work together but with autonomy. It sits above the physical layer, but below the network and transport layers. Its independence enables interoperability and interconnectivity, but from a security perspective, creates a challenge because a compromise at one layer isn't always known by the other layers. If the initial attack comes in at Layer 2, the rest of your network can be compromised in an instant. Network security is only as strong as your weakest link -- and that may well be the data link layer.

In Figure , a basic table of attacks and mitigation techniques that threaten Layer 2 are shown. Figure and Figure both give a better understanding of the problems faced at Layer 2. Many of the Cisco devices deployed at Layer 2 already have security features built in, including port security, private VLANs, and ACLs . Below is a description of what each of these features.

- Port security allows administrators to specify the number of PCs that can be connected to any single switch port.
- Private VLANs provide security and isolation between ports on a switch, which are members of the same VLAN. This feature ensures that users can communicate only with their default gateway, not with one another. Private VLANs are useful in DMZ environments.
- STP root guard/BPDU guard mitigates spanning-tree attacks by shutting down ports that would cause the Layer 2 topology to change.
- SSH support provides a secure, remote connection to a Layer 2 or a Layer 3 device. SSH provides more security for remote connections than Telnet does by providing strong encryption when a device is authenticated. This feature has both an SSH server and an SSH integrated client.
- VMPS (VLAN Membership Policy Server) enables specific MAC addresses to be bound to specific VLANs, allowing in-campus mobile users to always have the same network security permissions.
- IEEE 802.1X authentication secures the network by having users authenticate against a central database before any form of network connectivity is allowed. In contrast, most internal networks are accessible by just plugging into an internal Ethernet connection.
- Wire-rate ACLs allow access control lists to be processed without incurring a performance penalty. This feature enables ACLs to be deployed in situations where they might not normally be deployed.

Specific Configuration commands are shown in Figure which help secure the switch.

| Web Links http://www.cisco.com/en/US/about/ ac123/ac114/ac173/ac222/about_cisco_ packet_feature09186a0080142deb.html http://www.blackhat.com/presentations/
bh-usa-02/bh-us-02-convery-switches.pdf