Difference between revisions of "CCNP 3 Minimizing Service Loss and Data Theft in a Campus Network"
m (→Describing Unauthorized Access by Rogue Devices) |
m (→Configuring the Secure Shell Protocol) |
||
(5 intermediate revisions by the same user not shown) | |||
Line 8: | Line 8: | ||
*VLAN attacks | *VLAN attacks | ||
*Spoof attacks | *Spoof attacks | ||
− | *Switch device attacks | + | *Switch device attacks<br/> |
{|border=1 | {|border=1 | ||
|MAC address Flooding||Port Security | |MAC address Flooding||Port Security | ||
Line 27: | Line 27: | ||
|- | |- | ||
|SSH & Telnet attacks||Use SSHv2. Use Telnet with VTY ACLs | |SSH & Telnet attacks||Use SSHv2. Use Telnet with VTY ACLs | ||
+ | |} | ||
+ | ==Describing a MAC Flooding Attack== | ||
+ | {| | ||
+ | |[[Image:ScreenShot549.jpg|800px|left|thumb|MAC Flood Attack]] | ||
+ | |} | ||
+ | ==Describing Port Security== | ||
+ | {| | ||
+ | |[[Image:ScreenShot550.jpg|800px|left|thumb|Port Security]] | ||
+ | |} | ||
+ | ==Configuring Port Security on a Switch== | ||
+ | {| | ||
+ | |[[Image:ScreenShot551.jpg|800px|left|thumb|Configure Port Security]] | ||
+ | |- | ||
+ | | | ||
+ | '''Protect''': Frames from the non-allowed address are dropped, but there is no log of the violation.<br/> | ||
+ | '''Restrict''': Frames from the non-allowed address are dropped, a log message is created, and a Simple Network Management Protocol (SNMP) trap is sent.<br/> | ||
+ | '''Shut down''': If any frames are seen from a non-allowed address, the interface is errdisabled, a log entry is made, an SNMP trap is sent, and manual intervention or errdisable recovery must be used to make the interface usable. | ||
+ | |- | ||
+ | |[[Image:ScreenShot552.jpg|800px|left|thumb|Configuration steps]] | ||
+ | |- | ||
+ | |[[Image:ScreenShot553.jpg|800px|left|thumb|Verify Port Security]] | ||
+ | |} | ||
+ | ==Port Security with Sticky MAC Addresses== | ||
+ | {| | ||
+ | |[[Image:ScreenShot554.jpg|800px|left|thumb|Sticky MAC Addresses]] | ||
+ | |} | ||
+ | ==Authentication, Authorization, and Accounting== | ||
+ | {| | ||
+ | |[[Image:ScreenShot555.jpg|800px|left|thumb|Network Configuration]] | ||
+ | |} | ||
+ | ==Authentication Methods== | ||
+ | {| | ||
+ | |[[Image:ScreenShot556.jpg|800px|left|thumb|AAA Methods]] | ||
+ | |} | ||
+ | ==802.1x Port-Based Authentication== | ||
+ | {| | ||
+ | |[[Image:ScreenShot557.jpg|800px|left|thumb|802.1X]] | ||
+ | |- | ||
+ | |[[Image:ScreenShot558.jpg|800px|left|thumb|Configuring 802.1X]] | ||
+ | |- | ||
+ | | | ||
+ | '''force-authorized''': Disables 802.1x port-based authentication and causes the port to transition to the authorized state without any authentication exchange required. The port transmits and receives normal traffic without 802.1x-based authentication of the client. This is the default setting.<br/> | ||
+ | '''force-unauthorized''': Causes the port to remain in the unauthorized state, ignoring all attempts by the client to authenticate. The switch cannot provide authentication services to the client through the interface.<br/> | ||
+ | '''auto''': Enables 802.1x port-based authentication and causes the port to begin in the unauthorized state, allowing only EAPOL frames to be sent and received through the port. The authentication process begins when the link state of the port transitions from down to up (authenticator initiation) or when an EAPOL-start frame is received (supplicant initiation). The switch requests the identity of the client and begins relaying authentication messages between the client and the authentication server. The switch uniquely identifies each client attempting to access the network with the client MAC address. | ||
+ | |} | ||
+ | =Protecting Against VLAN Attacks= | ||
+ | ==Explaining VLAN Hopping== | ||
+ | {| | ||
+ | |[[Image:ScreenShot559.jpg|800px|left|thumb|VLAN Hopping with Double Tagging]] | ||
+ | |- | ||
+ | |[[Image:ScreenShot560.jpg|800px|left|thumb|VLAN Hopping with Double Tagging]] | ||
+ | |} | ||
+ | ==Mitigating VLAN Hopping== | ||
+ | {| | ||
+ | |[[Image:ScreenShot561.jpg|800px|left|thumb|Mitigating VLAN Hopping]] | ||
+ | |} | ||
+ | ==VLAN Access Control Lists== | ||
+ | {| | ||
+ | |[[Image:ScreenShot562.jpg|800px|left|thumb|VLAN Access Control Lists]] | ||
+ | |} | ||
+ | ==Configuring VACLs== | ||
+ | {| | ||
+ | |[[Image:ScreenShot563.jpg|800px|left|thumb|Configure VACLs]] | ||
+ | |} | ||
+ | ==Private VLANs and Protected Ports== | ||
+ | {| | ||
+ | |[[Image:ScreenShot564.jpg|800px|left|thumb|PVLANs]] | ||
+ | |- | ||
+ | |[[Image:ScreenShot565.jpg|800px|left|thumb|PVLAN Port Types]] | ||
+ | |} | ||
+ | =Protecting Against Spoof Attacks= | ||
+ | ==Describing a DHCP Spoof Attack== | ||
+ | {| | ||
+ | |[[Image:ScreenShot566.jpg|800px|left|thumb|DHCP Spoof Attack]] | ||
+ | |} | ||
+ | ==Describing DHCP Snooping== | ||
+ | {| | ||
+ | |[[Image:ScreenShot567.jpg|800px|left|thumb|DHCP Spoofing Attacks]] | ||
+ | |} | ||
+ | ==Configuring DHCP Snooping== | ||
+ | {| | ||
+ | |[[Image:ScreenShot568.jpg|800px|left|thumb|DHCP Snooping]] | ||
+ | |- | ||
+ | |[[Image:ScreenShot569.jpg|800px|left|thumb|IP Source Guard]] | ||
+ | |} | ||
+ | ==Describing ARP Spoofing== | ||
+ | {| | ||
+ | |[[Image:ScreenShot570.jpg|800px|left|thumb|ARP Spoofing]] | ||
+ | |} | ||
+ | ==Dynamic ARP Inspection== | ||
+ | {| | ||
+ | |[[Image:ScreenShot571.jpg|800px|left|thumb|DAI]] | ||
+ | |} | ||
+ | =STP Security Mechanisms= | ||
+ | ==Protecting the Operation of STP== | ||
+ | {| | ||
+ | |[[Image:ScreenShot572.jpg|800px|left|thumb|Portfast protection]] | ||
+ | |} | ||
+ | ==Configuring BPDU Guard== | ||
+ | {| | ||
+ | |[[Image:ScreenShot573.jpg|800px|left|thumb|Enabling and Verifying BPDY Guard]] | ||
+ | |} | ||
+ | ==Configuring BPDU Filtering== | ||
+ | {| | ||
+ | |[[Image:ScreenShot574.jpg|800px|left|thumb|BPDu Filtering]] | ||
+ | |} | ||
+ | ==STP Root Guard== | ||
+ | {| | ||
+ | |[[Image:ScreenShot575.jpg|800px|left|thumb|STP Root Guard]] | ||
+ | |} | ||
+ | =Preventing STP Forwarding Loops= | ||
+ | ==Unidirectional Link Detection== | ||
+ | {| | ||
+ | |[[Image:ScreenShot576.jpg|800px|left|thumb|UDLD]] | ||
+ | |} | ||
+ | ==Loop Guard== | ||
+ | {| | ||
+ | |[[Image:ScreenShot577.jpg|800px|left|thumb|Loop Guard]] | ||
+ | |- | ||
+ | |[[Image:ScreenShot578.jpg|800px|left|thumb|Before Loop Guard]] | ||
+ | |- | ||
+ | |[[Image:ScreenShot579.jpg|800px|left|thumb|With Loop Guard]] | ||
+ | |} | ||
+ | ==Comparing Loop Guard and UDLD== | ||
+ | {| | ||
+ | |[[Image:ScreenShot580.jpg|800px|left|thumb|]] | ||
+ | |} | ||
+ | =Securing Network Switches= | ||
+ | ==Describing Vulnerabilities in CDP== | ||
+ | {| | ||
+ | |[[Image:ScreenShot581.jpg|800px|left|thumb|CDP Attack]] | ||
+ | |} | ||
+ | ==Telnet Protocol Vulnerabilities== | ||
+ | {| | ||
+ | |[[Image:ScreenShot582.jpg|800px|left|thumb|Telnet attach]] | ||
+ | |} | ||
+ | ==Configuring the Secure Shell Protocol== | ||
+ | {| | ||
+ | |[[Image:ScreenShot583.jpg|800px|left|thumb|SSH]] | ||
+ | |} | ||
+ | <source lang=cli> | ||
+ | Switch(config)# aaa new-model | ||
+ | Switch(config)# aaa authentication login default local | ||
+ | Switch(config)# username Joe password User | ||
+ | Switch(config)# ip domain-name sshtest.lab | ||
+ | Switch(config)# crypto key generate key | ||
+ | Switch(config)# line vty 0 15 | ||
+ | Switch(config-line)# login local | ||
+ | Switch(config-line)# transport input ssh | ||
+ | </source> | ||
+ | |||
+ | ==Applying ACLs to vty Lines== | ||
+ | {| | ||
+ | |[[Image:ScreenShot584.jpg|800px|left|thumb|VTY ACLs]] | ||
+ | |} | ||
+ | ==Best Practices for Switch Security== | ||
+ | {| | ||
+ | |[[Image:ScreenShot585.jpg|800px|left|thumb|Switch Security]] | ||
+ | |- | ||
+ | |[[Image:ScreenShot586.jpg|800px|left|thumb|Switch Security]] | ||
|} | |} |
Latest revision as of 09:41, 21 February 2011
Contents
- 1 Understanding Switch Security Issues
- 1.1 Describing Unauthorized Access by Rogue Devices
- 1.2 Switch Attack Categories
- 1.3 Describing a MAC Flooding Attack
- 1.4 Describing Port Security
- 1.5 Configuring Port Security on a Switch
- 1.6 Port Security with Sticky MAC Addresses
- 1.7 Authentication, Authorization, and Accounting
- 1.8 Authentication Methods
- 1.9 802.1x Port-Based Authentication
- 2 Protecting Against VLAN Attacks
- 3 Protecting Against Spoof Attacks
- 4 STP Security Mechanisms
- 5 Preventing STP Forwarding Loops
- 6 Securing Network Switches
Understanding Switch Security Issues
Describing Unauthorized Access by Rogue Devices
Switch Attack Categories
- MAC layer attacks
- VLAN attacks
- Spoof attacks
- Switch device attacks
MAC address Flooding | Port Security |
VLAN Hooping | Tighten up trunk configurations and the nogotiation state |
Attacks between devices on a common VLAN | Implement Private VLANS(PVLANs) |
DHCP Spoofing | USe DHCP Snooping |
Spanning tree compromises | Proactively configure the primary and backup root devices, Enable root guard |
MAC Spoofing | Use DHCP Snooping. Port security. |
ARP Spoofing | Use Dynamic ARP Inspection. DHCP Snooping, Port Security |
CDP Manipulation | Diable CDP on al ports where it is not intentionally used. |
SSH & Telnet attacks | Use SSHv2. Use Telnet with VTY ACLs |
Describing a MAC Flooding Attack
Describing Port Security
Configuring Port Security on a Switch
Protect: Frames from the non-allowed address are dropped, but there is no log of the violation. |
Port Security with Sticky MAC Addresses
Authentication, Authorization, and Accounting
Authentication Methods
802.1x Port-Based Authentication
force-authorized: Disables 802.1x port-based authentication and causes the port to transition to the authorized state without any authentication exchange required. The port transmits and receives normal traffic without 802.1x-based authentication of the client. This is the default setting. |
Protecting Against VLAN Attacks
Explaining VLAN Hopping
Mitigating VLAN Hopping
VLAN Access Control Lists
Configuring VACLs
Private VLANs and Protected Ports
Protecting Against Spoof Attacks
Describing a DHCP Spoof Attack
Describing DHCP Snooping
Configuring DHCP Snooping
Describing ARP Spoofing
Dynamic ARP Inspection
STP Security Mechanisms
Protecting the Operation of STP
Configuring BPDU Guard
Configuring BPDU Filtering
STP Root Guard
Preventing STP Forwarding Loops
Unidirectional Link Detection
Loop Guard
Comparing Loop Guard and UDLD
Securing Network Switches
Describing Vulnerabilities in CDP
Telnet Protocol Vulnerabilities
Configuring the Secure Shell Protocol
Switch(config)# aaa new-model
Switch(config)# aaa authentication login default local
Switch(config)# username Joe password User
Switch(config)# ip domain-name sshtest.lab
Switch(config)# crypto key generate key
Switch(config)# line vty 0 15
Switch(config-line)# login local
Switch(config-line)# transport input ssh