Switch Security

Question 1

The switch maintains a ________________, which records the association between the MAC address of a device and the IP address it has been assigned by an authorized DHCP server. This table helps the switch identify legitimate DHCP responses.

Answer 1

DHCP Snooping Binding Table

Question 2

What is DHCP Snooping?

Answer 2

DHCP Snooping is a security feature available on Cisco switches. It works by inspecting DHCP messages exchanged between DHCP clients and DHCP servers and compares it to the DHCP Snooping Binding Table to make sure that the association between the MAC Address of the device and the IP address is valid. If it’s not it will drop the packet

Question 3

How would you enable DHCP Snooping on a switch?

Answer 3

ip dhcp snooping
ip dchp snooping {vlan} (You want to make sure you do this for all VLANs)

int {int}
ip dhcp snooping trust (You want to enable this on upstream ports pointing to the valid DHCP server)

Question 4

When you are enabling ip dhcp snooping trust, what is happening with that command?

Answer 4

You are enabling that interface to be a trusted interface to receive valid DHCP traffic

Question 5

What happens if DHCP traffic arrives a port that is not trusted?

Answer 5

The switch will drop that DHCP traffic

Question 6

What protocol would you use to stop a Man in the Middle attack?

Answer 6

DAI - Dynamic ARP Inspection

Question 7

True or False: DAI (Dynamic ARP Inspection) can work without DHCP Snooping being turned on

Answer 7

False. DHCP Snooping has to be turned on for DAI to work because DHCP Snooping is the protocol that is actually building the DHCP Snooping Binding Table that DAI will use to inspect traffic.

Question 8

Briefly explain DAI

Answer 8

DAI is a security feature that works by inspecting ARP packets as they traverse the network and it validates the mapping between IP addresses and MAC addresses via the DHCP Snooping Binding Table

Question 9

How does DAI know about the mappings between the IP Address and MAC Address?

Answer 9

The DHCP Snooping Binding Table

Question 10

How would you configure DAI?

Answer 10

int {int}
ip arp inspection trust
(this for all non-DHCP related hosts on the switch such as servers, routers, etc. They have to be trusted)

ip arp inspection vlan {vlan-id)
(This is for all your PCs that are getting their IP Address from DHCP, they shouldn’t be trusted ports so they need DAI on them)

Question 11

At what layer is DAI enabled on?

Answer 11

Layer 2 (VLAN Layer) and Layer 3.

Context: While DAI primarily operates at Layer 2, its purpose is to protect the integrity of ARP data used at Layer 3. It verifies that the ARP information provided by devices matches the information in the DHCP binding table. This helps ensure that the IP-to-MAC address mappings used at Layer 3 are accurate and haven’t been tampered with by malicious devices.

Question 12

How would you configure port security at the interface level?

Answer 12

int {int}
switchport port-security

Question 13

If you configure Port Security with no additional parameters then how many MAC Addresses are allowed to transmit on that port?

Answer 13

1

Question 14

True or False: The port security command should only be enabled on the ports that something is plugged into?

Answer 14

False. It should be enabled on every port on the switch because it controls the number of MAC Addresses that a port will accept traffic from

Question 15

Describe a scenario where Port Security would be a good thing.

Answer 15

If someone unplugged a PC from a wall port and stuck a wifi access point in it’s place and connected multiple devices to it. At that point the switch would be receiving traffic from multiple MAC Addresses and if Port security was configured then it would only accept traffic from 1 MAC address and drop all other packets.

Question 16

How does Port Security know which device is allowed?

Answer 16

The one currently in the MAC Address table for that port.

Question 17

Are you able switch out devices with Port Security and it learn another MAC Address?

Answer 17

Yes, the port is not locked down to a particular MAC Address. It’s just the number of MAC Addresses the port will accept traffic from

Question 18

How would you verify a interfaces port security settings?

Answer 18

show port-security int {int}

Question 19

What are the three Security Violation Actions for Port Security?

Answer 19

Shutdown (default)
Protect
Restrict

Question 20

What Violation Action is this: The interface is placed into the error-disabled state, blocking all traffic

Answer 20

Shutdown

Question 21

What violation action is this: Traffic from unauthorized addresses is dropped. Traffic from allowed addresses is forwarded. Traffic from the learned MAC Address will still be able to transmit. All other hosts’ traffic will be dropped

Answer 21

Protect

Question 22

What Security Violation Action is this: Traffic from unauthorized addresses is dropped, logged and the violation counter incremented. Traffic from allowed addresses is forwarded

Answer 22

Restrict

Question 23

How would you change the violation actions manually?

Answer 23

int {int}
switchport port-security violation protect (or restrict)

remember shutdown is the default

Question 24

What command would you use to auto recover from a port being disabled by a port security violation?

Answer 24

errdisable recovery cause psecure-violation
errdisable recovery interval 600

Question 25

By default how many MAC Addresses are allowed when generic Port Security is enabled?

Answer 25

1

Question 26

What commands would you use to set it to multiple MAC Addresses allowed for Port Security?

Answer 26

int {int}
switchport port-security maximum 2 (or greater)

Question 27

What commands would you use to lock down an access port to one static MAC Address?

Answer 27

int {int}
switchport port-security
switchport port-security mac-address {mac-address}
switchport port-security maximum 1

Question 28

If you didn’t want to have to find every MAC Address and add it to an access port for Port Security how could you tell the access port to just use the MAC Address already in place?

Answer 28

int {int}
switchport port-security
switchport port-security mac-address sticky

Question 29

What command would verify port security addresses?

Answer 29

show port-security address

Question 30

If you wanted to see how many ports had been shut down because of a violation what command would you use?

Answer 30

show port-security

Question 31

When viewing the command show port-security address, what does Dynamic Configure and SecureConfigured mean?

Answer 31

Dynamic Configured = Dynamically learned MAC Address
SecureConfigured = Manually configured at the access port level