Difference between revisions of "CCNP 3 Minimizing Service Loss and Data Theft in a Campus Network"
m (→Switch Attack Categories) |
m (→Describing a MAC Flooding Attack) |
||
Line 31: | Line 31: | ||
{| | {| | ||
|[[Image:ScreenShot549.jpg|800px|left|thumb|MAC Flood Attack]] | |[[Image:ScreenShot549.jpg|800px|left|thumb|MAC Flood Attack]] | ||
+ | |} | ||
+ | ==Describing Port Security== | ||
+ | {| | ||
+ | |[[Image:ScreenShot550.jpg|800px|left|thumb|Port Security]] | ||
+ | |} | ||
+ | ==Configuring Port Security on a Switch== | ||
+ | {| | ||
+ | |[[Image:ScreenShot551.jpg|800px|left|thumb|Configure Port Security]] | ||
+ | |- | ||
+ | | | ||
+ | '''Protect''': Frames from the non-allowed address are dropped, but there is no log of the violation.<br/> | ||
+ | '''Restrict''': Frames from the non-allowed address are dropped, a log message is created, and a Simple Network Management Protocol (SNMP) trap is sent.<br/> | ||
+ | '''Shut down''': If any frames are seen from a non-allowed address, the interface is errdisabled, a log entry is made, an SNMP trap is sent, and manual intervention or errdisable recovery must be used to make the interface usable. | ||
+ | |- | ||
+ | |[[Image:ScreenShot552.jpg|800px|left|thumb|Configuration steps]] | ||
+ | |- | ||
+ | |[[Image:ScreenShot553.jpg|800px|left|thumb|Verify Port Security]] | ||
+ | |} | ||
+ | ==Port Security with Sticky MAC Addresses== | ||
+ | {| | ||
+ | |[[Image:ScreenShot554.jpg|800px|left|thumb|Sticky MAC Addresses]] | ||
+ | |} | ||
+ | ==Authentication, Authorization, and Accounting== | ||
+ | {| | ||
+ | |[[Image:ScreenShot555.jpg|800px|left|thumb|Network Configuration]] | ||
+ | |} | ||
+ | ==Authentication Methods== | ||
+ | {| | ||
+ | |[[Image:ScreenShot556.jpg|800px|left|thumb|AAA Methods]] | ||
+ | |} | ||
+ | ==802.1x Port-Based Authentication== | ||
+ | {| | ||
+ | |[[Image:ScreenShot557.jpg|800px|left|thumb|802.1X]] | ||
+ | |- | ||
+ | |[[Image:ScreenShot558.jpg|800px|left|thumb|Configuring 802.1X]] | ||
+ | |- | ||
+ | | | ||
+ | '''force-authorized''': Disables 802.1x port-based authentication and causes the port to transition to the authorized state without any authentication exchange required. The port transmits and receives normal traffic without 802.1x-based authentication of the client. This is the default setting.<br/> | ||
+ | '''force-unauthorized''': Causes the port to remain in the unauthorized state, ignoring all attempts by the client to authenticate. The switch cannot provide authentication services to the client through the interface.<br/> | ||
+ | '''auto''': Enables 802.1x port-based authentication and causes the port to begin in the unauthorized state, allowing only EAPOL frames to be sent and received through the port. The authentication process begins when the link state of the port transitions from down to up (authenticator initiation) or when an EAPOL-start frame is received (supplicant initiation). The switch requests the identity of the client and begins relaying authentication messages between the client and the authentication server. The switch uniquely identifies each client attempting to access the network with the client MAC address. | ||
+ | |} | ||
+ | =Protecting Against VLAN Attacks= | ||
+ | ==Explaining VLAN Hopping== | ||
+ | {| | ||
+ | |[[Image:ScreenShot559.jpg|800px|left|thumb|VLAN Hopping with Double Tagging]] | ||
+ | |- | ||
+ | |[[Image:ScreenShot560.jpg|800px|left|thumb|VLAN Hopping with Double Tagging]] | ||
+ | |} | ||
+ | ==Mitigating VLAN Hopping== | ||
+ | {| | ||
+ | |[[Image:ScreenShot561.jpg|800px|left|thumb|Mitigating VLAN Hopping]] | ||
+ | |} | ||
+ | ==VLAN Access Control Lists== | ||
+ | {| | ||
+ | |[[Image:ScreenShot562.jpg|800px|left|thumb|VLAN Access Control Lists]] | ||
+ | |} | ||
+ | ==Configuring VACLs== | ||
+ | {| | ||
+ | |[[Image:ScreenShot563.jpg|800px|left|thumb|Configure VACLs]] | ||
+ | |} | ||
+ | ==Private VLANs and Protected Ports== | ||
+ | {| | ||
+ | |[[Image:ScreenShot564.jpg|800px|left|thumb|PVLANs]] | ||
+ | |- | ||
+ | |[[Image:ScreenShot565.jpg|800px|left|thumb|PVLAN Port Types]] | ||
+ | |} | ||
+ | =Protecting Against Spoof Attacks= | ||
+ | ==Describing a DHCP Spoof Attack== | ||
+ | {| | ||
+ | |[[Image:ScreenShot566.jpg|800px|left|thumb|DHCP Spoof Attack]] | ||
+ | |} | ||
+ | ==Describing DHCP Snooping== | ||
+ | {| | ||
+ | |[[Image:ScreenShot567.jpg|800px|left|thumb|DHCP Spoofing Attacks]] | ||
+ | |} | ||
+ | ==Configuring DHCP Snooping== | ||
+ | {| | ||
+ | |[[Image:ScreenShot568.jpg|800px|left|thumb|DHCP Snooping]] | ||
|} | |} |
Revision as of 15:42, 15 September 2010
Contents
- 1 Understanding Switch Security Issues
- 1.1 Describing Unauthorized Access by Rogue Devices
- 1.2 Switch Attack Categories
- 1.3 Describing a MAC Flooding Attack
- 1.4 Describing Port Security
- 1.5 Configuring Port Security on a Switch
- 1.6 Port Security with Sticky MAC Addresses
- 1.7 Authentication, Authorization, and Accounting
- 1.8 Authentication Methods
- 1.9 802.1x Port-Based Authentication
- 2 Protecting Against VLAN Attacks
- 3 Protecting Against Spoof Attacks
Understanding Switch Security Issues
Describing Unauthorized Access by Rogue Devices
Switch Attack Categories
- MAC layer attacks
- VLAN attacks
- Spoof attacks
- Switch device attacks
MAC address Flooding | Port Security |
VLAN Hooping | Tighten up trunk configurations and the nogotiation state |
Attacks between devices on a common VLAN | Implement Private VLANS(PVLANs) |
DHCP Spoofing | USe DHCP Snooping |
Spanning tree compromises | Proactively configure the primary and backup root devices, Enable root guard |
MAC Spoofing | Use DHCP Snooping. Port security. |
ARP Spoofing | Use Dynamic ARP Inspection. DHCP Snooping, Port Security |
CDP Manipulation | Diable CDP on al ports where it is not intentionally used. |
SSH & Telnet attacks | Use SSHv2. Use Telnet with VTY ACLs |
Describing a MAC Flooding Attack
Describing Port Security
Configuring Port Security on a Switch
Protect: Frames from the non-allowed address are dropped, but there is no log of the violation. |
Port Security with Sticky MAC Addresses
Authentication, Authorization, and Accounting
Authentication Methods
802.1x Port-Based Authentication
force-authorized: Disables 802.1x port-based authentication and causes the port to transition to the authorized state without any authentication exchange required. The port transmits and receives normal traffic without 802.1x-based authentication of the client. This is the default setting. |