LearnCCNA

Search

Objective 5.7

Configure and verify Layer 2 security features (DHCP snooping, dynamic ARP inspection, and port security)

Routers and firewalls protect the boundaries of the network, but many attacks happen inside a single VLAN, at Layer 2, where there is no router to filter. The three features in this objective run on the access switch and protect against the LAN attacks introduced in 5.1: rogue DHCP servers, ARP poisoning, and unauthorized or excessive MAC addresses. Each has a small set of commands, a notion of trusted versus untrusted ports, and a set of default numbers to memorize.

DHCP snooping

DHCP snooping makes the switch inspect DHCP messages and drop the ones that should not exist. It relies on classifying each port as trusted or untrusted:

  • Trusted ports are the ones leading toward legitimate DHCP servers: the uplink to the distribution switch, the port to the DHCP server itself, trunks between switches. Any DHCP message is allowed on a trusted port.
  • Untrusted ports are everything else, which by default is every port once snooping is enabled. On an untrusted port the switch drops DHCP server messages (OFFER, ACK, NAK), because a legitimate server would never be connected there. This single rule defeats DHCP spoofing.

The switch also performs extra checks on client messages arriving on untrusted ports: the source MAC address of the frame must match the client hardware address (chaddr) field inside the DHCP message (dropping starvation attacks that fake the DHCP field with a single real MAC), and RELEASE or DECLINE messages are checked against the binding table so that an attacker cannot release another host’s lease.

As it watches legitimate DHCP exchanges complete, the switch builds the DHCP snooping binding table: a list of MAC address, IP address, lease time, VLAN, and interface for every client that obtained an address through an untrusted port. This table is not just for DHCP snooping; Dynamic ARP Inspection and IP Source Guard both depend on it.

Configuration on switch SW1, where G1/0/24 is the uplink toward the DHCP server:

SW1(config)# ip dhcp snooping
SW1(config)# ip dhcp snooping vlan 10,20
! Fix the option 82 problem (explained below)
SW1(config)# no ip dhcp snooping information option
SW1(config)# interface GigabitEthernet1/0/24
SW1(config-if)# ip dhcp snooping trust
SW1(config-if)# exit
! Rate-limit DHCP messages on access ports to stop starvation floods
SW1(config)# interface range GigabitEthernet1/0/1 - 23
SW1(config-if-range)# ip dhcp snooping limit rate 10

Both the global ip dhcp snooping and the per-VLAN ip dhcp snooping vlan command are required; snooping is not active on any VLAN until both exist. This is a very common exam trick: a configuration that shows only one of the two.

Option 82. By default, when DHCP snooping is enabled the switch inserts DHCP option 82 (the relay agent information option) into client requests it forwards. That behavior is meant for a switch acting as a relay, and a plain Layer 2 access switch inserting it causes a problem: the request carries option 82 but has a giaddr (gateway address) of 0.0.0.0, and many DHCP servers, and Cisco routers acting as relay agents or servers, drop such packets as invalid. The symptom is “clients stopped getting addresses right after I enabled DHCP snooping.” The fix is no ip dhcp snooping information option on the switch (or ip dhcp relay information trust-all on the relay router).

Rate limiting. ip dhcp snooping limit rate PPS on an interface limits DHCP packets per second. If the limit is exceeded, the port is err-disabled. You can have the switch recover it automatically with errdisable recovery cause dhcp-rate-limit.

Verification:

SW1# show ip dhcp snooping
Switch DHCP snooping is enabled
DHCP snooping is configured on following VLANs:
10,20
DHCP snooping is operational on following VLANs:
10,20
Insertion of option 82 is disabled
Interface                  Trusted    Allow option    Rate limit (pps)
-----------------------    -------    ------------    ----------------
GigabitEthernet1/0/1       no         no              10
GigabitEthernet1/0/24      yes        yes             unlimited

SW1# show ip dhcp snooping binding
MacAddress          IpAddress        Lease(sec)  Type           VLAN  Interface
------------------  ---------------  ----------  -------------  ----  ---------
00:1A:2B:3C:4D:5E   10.1.10.51       86122       dhcp-snooping  10    Gi1/0/3

Dynamic ARP Inspection

Dynamic ARP Inspection (DAI) stops ARP poisoning by checking every ARP message that arrives on an untrusted port and dropping any whose sender IP-to-MAC mapping is not valid. “Valid” means it appears in the DHCP snooping binding table (or in a manually configured ARP ACL for hosts with static addresses). This is why DAI is normally deployed together with DHCP snooping: without the binding table DAI has nothing to compare against and drops all ARP on untrusted ports.

Like DHCP snooping, DAI uses trusted and untrusted ports. All ports are untrusted by default. Ports facing other switches should be trusted, because the other switch has already inspected the ARP traffic from its own access ports (and because its hosts are not in this switch’s binding table). ARP messages on trusted ports are not inspected.

! DHCP snooping already enabled for VLAN 10 as above
SW1(config)# ip arp inspection vlan 10
SW1(config)# interface GigabitEthernet1/0/24
SW1(config-if)# ip arp inspection trust
SW1(config-if)# exit
! Optional extra checks
SW1(config)# ip arp inspection validate src-mac dst-mac ip
! Optional: rate limit ARP on an access port (default 15 pps untrusted)
SW1(config)# interface GigabitEthernet1/0/5
SW1(config-if)# ip arp inspection limit rate 20

DAI is enabled per VLAN with ip arp inspection vlan LIST; there is no separate global enable command like DHCP snooping has. By default DAI checks only the sender IP and sender MAC inside the ARP message against the binding table. The ip arp inspection validate command adds optional checks:

  • src-mac: the Ethernet source MAC must equal the sender MAC in the ARP body.
  • dst-mac: for ARP replies, the Ethernet destination MAC must equal the target MAC in the ARP body.
  • ip: drop ARP messages with invalid or unexpected IPs (0.0.0.0, 255.255.255.255, multicast) and check the target IP on replies.

Untrusted ports also rate-limit ARP at 15 packets per second by default; a port that exceeds its limit is err-disabled (recover with errdisable recovery cause arp-inspection). Trusted ports have no limit by default.

For hosts with static IP addresses that never appear in the DHCP binding table, create an ARP ACL and attach it with ip arp inspection filter ACL-NAME vlan 10, or add a static binding with ip source binding MAC vlan VLAN IP interface INTERFACE.

Verification:

SW1# show ip arp inspection
Source Mac Validation      : Enabled
Destination Mac Validation : Enabled
IP Address Validation      : Enabled

 Vlan     Configuration    Operation   ACL Match          Static ACL
 ----     -------------    ---------   ---------          ----------
   10     Enabled          Active

 Vlan     ACL Logging      DHCP Logging      Probe Logging
 ----     -----------      ------------      -------------
   10     Deny             Deny              Off

 Vlan      Forwarded        Dropped     DHCP Drops      ACL Drops
 ----      ---------        -------     ----------      ---------
   10           1520             14             14              0

SW1# show ip arp inspection interfaces
 Interface        Trust State     Rate (pps)    Burst Interval
 ---------------  -----------     ----------    --------------
 Gi1/0/1          Untrusted               15                 1
 Gi1/0/24         Trusted                 None               N/A

Port security

Port security limits which MAC addresses, and how many, may send traffic into a switch port. It defends against MAC flooding (an attacker generating thousands of source MACs to overflow the MAC address table), against someone plugging an unauthorized device or a rogue switch into a wall jack, and against MAC spoofing of a specific known host.

Requirements and defaults:

  • The port must be statically configured as an access port or a trunk port (switchport mode access or switchport mode trunk). Port security cannot be enabled on a port in DTP dynamic mode (dynamic auto or dynamic desirable); IOS rejects the command with “Command rejected: GigabitEthernet1/0/5 is a dynamic port.” Since dynamic auto is the default on most switches, forgetting switchport mode access is the number one reason switchport port-security fails.
  • Enable it with switchport port-security. With no other options, the maximum is 1 MAC address, the violation mode is shutdown, and the first MAC address learned dynamically is the one allowed (until the port resets).
  • switchport port-security maximum N raises the limit, for example to 2 for a phone plus a PC (on a voice VLAN port, the phone counts).
  • switchport port-security mac-address AAAA.BBBB.CCCC statically defines an allowed MAC. It is stored in the running configuration.
  • switchport port-security mac-address sticky tells the switch to learn MAC addresses dynamically and then write them into the running configuration as if they were static. If you save the config (copy running-config startup-config), they survive a reboot. Without sticky, dynamically learned secure addresses are lost when the port goes down or the switch reloads. Sticky is the practical way to lock a port to whatever is plugged in today without typing MAC addresses.
SW1(config)# interface GigabitEthernet1/0/5
SW1(config-if)# switchport mode access
SW1(config-if)# switchport access vlan 10
SW1(config-if)# switchport port-security
SW1(config-if)# switchport port-security maximum 2
SW1(config-if)# switchport port-security mac-address sticky
SW1(config-if)# switchport port-security violation restrict
SW1(config-if)# exit
! A port pinned to one specific printer, default shutdown mode
SW1(config)# interface GigabitEthernet1/0/6
SW1(config-if)# switchport mode access
SW1(config-if)# switchport port-security
SW1(config-if)# switchport port-security mac-address 0050.56AB.1234

After a device connects to G1/0/5, the running configuration gains a line like switchport port-security mac-address sticky 0011.2233.4455.

Violation modes. A violation occurs when a frame arrives from a MAC address that is not allowed on the port, either because the maximum is already reached by other addresses or because a static address is configured and this is a different one. Also, a MAC that is secured on one port appearing on another port of the same VLAN is a violation. What happens next depends on the mode:

Mode Drops offending frames Sends syslog/SNMP alert Increments violation counter Port disabled
shutdown (default) Yes (all traffic) Yes Yes Yes, err-disabled
restrict Yes (offending only) Yes Yes No
protect Yes (offending only) No No No

In shutdown mode the port goes into the err-disabled state: the LED goes amber, the port is effectively shut down for every device, and show interfaces reports it as down/down (err-disabled). To recover, an administrator must issue shutdown followed by no shutdown on the interface, or the switch must have automatic recovery enabled:

SW1(config)# errdisable recovery cause psecure-violation
SW1(config)# errdisable recovery interval 300

The default recovery interval is 300 seconds. Recovery re-enables the port; if the offending device is still connected, it will simply be err-disabled again.

Restrict and protect both keep the port up and continue forwarding traffic from allowed MACs while silently dropping frames from disallowed MACs. The only difference is that restrict logs the event (syslog message and SNMP trap) and counts violations, while protect does nothing observable. For that reason protect is rarely recommended; you would never know an attack was happening.

Aging. By default, secure MAC addresses do not age out. switchport port-security aging time MINUTES sets an aging time, and switchport port-security aging type {absolute | inactivity} decides whether the timer counts from when the address was learned (absolute) or from the last frame seen (inactivity). By default aging applies only to dynamically learned addresses; switchport port-security aging static extends it to static ones. Aging is useful on ports where devices come and go, such as conference rooms, so that old addresses free up the maximum.

Verification:

SW1# show port-security interface GigabitEthernet1/0/5
Port Security              : Enabled
Port Status                : Secure-up
Violation Mode             : Restrict
Aging Time                 : 0 mins
Aging Type                 : Absolute
SecureStatic Address Aging : Disabled
Maximum MAC Addresses      : 2
Total MAC Addresses        : 2
Configured MAC Addresses   : 0
Sticky MAC Addresses       : 2
Last Source Address:Vlan   : 0011.2233.4455:10
Security Violation Count   : 3

SW1# show port-security
Secure Port  MaxSecureAddr  CurrentAddr  SecurityViolation  Security Action
                (Count)       (Count)          (Count)
---------------------------------------------------------------------------
    Gi1/0/5              2            2                  3         Restrict
    Gi1/0/6              1            1                  0         Shutdown
---------------------------------------------------------------------------
Total Addresses in System (excluding one mac per port)     : 1
Max Addresses limit in System (excluding one mac per port) : 8192

SW1# show port-security address
          Secure Mac Address Table
-------------------------------------------------------------------
Vlan    Mac Address       Type                     Ports   Remaining Age
                                                              (mins)
----    -----------       ----                     -----   -------------
  10    0011.2233.4455    SecureSticky             Gi1/0/5        -
  10    0011.2233.6677    SecureSticky             Gi1/0/5        -
  10    0050.56ab.1234    SecureConfigured         Gi1/0/6        -

In show port-security interface, Port Status is the key field: Secure-up means working normally, Secure-down means the port is down (cable unplugged), and Secure-shutdown means it was err-disabled by a violation. In shutdown mode, Security Violation Count will show 1 and stay there until the port is recovered.