Defending Against Burning Attacks

There is no way to protect a non-PES from a burning attack, even if the static configuration of the wattage can help limit the damage to the attached device. The burning attack requires physical access to inject the signaling to force 42 V into the CAT5 cable. If an attacker has access to the cable, he can also inject 110-220 V into it, which causes more damage in the PES. Therefore, the risk of this attack does not increase by enabling PoE on the port.

NOTE A related issue is when a powered device is disconnected and another one is immediately connected: The power is still applied. It takes a couple of seconds for a switch to discover that a PES has been disconnected, so wait 10 seconds before you connect a new device.

Oftentimes, an attacker short cuts the power delivery of a PES in a vain attempt to damage the switch. It is vain indeed—short-circuit protection is built into all the switch's powered ports. The same circuitry also prevents the delivery of more power than negotiated.

NOTE Some line cards completely shut down the power on all ports when detecting a short cut on a single port. Therefore, critical PES—such as surveillance cameras—should not be placed on the same line card as noncritical PES (such as an IP phone in a lobby).

For a quick-reference list or tool on how to defend against attacks, use the countermeasures shown in Table 8-1.

Table 8-1 Countermeasures

Attack	Countermeasure
Power gobbling	Configuration: Configure the exact amount of power per port.
Power changing	Configuration: Configure the exact amount of power per port. For Cisco prestandard, you can also disable CDP on the port.
Shutting down	Provide UPS to the switch and physically protect the cable.
Burning	Mostly a theoretical attack. Physical security is a good countermeasure.

References 143

Continue reading here: HSRP Mechanics

Was this article helpful?

0 0