Switch Spoofing
Recall from Chapter 5, "VLANs and Trunks," that two switches can be connected by a common trunk link that can carry traffic from multiple VLANs. The trunk doesn't have to exist all the time. The switches dynamically can negotiate its use and its encapsulation mode by exchanging Dynamic Trunking Protocol (DTP) messages.
Although DTP can make switch administration easier, it also can expose switch ports to be compromised. Suppose that a switch port is left to its default configuration, in which the trunking mode is auto. Normally, the switch port would wait to be asked by another switch in the auto or on mode to become a trunk.
Now suppose that an end user's PC is connected to that port. A well-behaved end user would not use DTP at all, so the port would come up in access mode with a single-access VLAN. A malicious user, however, might exploit the use of DTP and attempt to negotiate a trunk with the switch port. This makes the PC appear to be another switch; in effect, the PC is spoofing a switch.
After the trunk is negotiated, the attacker has access to any VLAN that is permitted to pass over the trunk. If the switch port has been left to its default configuration, all VLANs configured on the switch are allowed onto the trunk. This scenario is shown in Figure 16-2. The attacker can receive any traffic being sent over the trunk on any VLAN. In addition, he can send traffic into any VLAN of his choice.
Figure 16-2 An Example of Switch Spoofing to Gain Access to a Trunk
Default Switch Port Configural switchport mode dynamic auto switchport trunk allowed vlan all
Catalyst A
Default Switch Port Configural switchport mode dynamic auto switchport trunk allowed vlan all
- Negotiated Trunk VLANs 1-4094
Via VLAN 10
Via VLAN 10
To demonstrate this further, consider the output in Example 16-4, which shows the default access switch port configuration. Notice that trunking is possible because the port is set to dynamic auto mode, awaiting DTP negotiation from a connected device. If a trunk is negotiated, all VLANs are permitted to be carried over it.
Example 16-4 Displaying the Default Switch Port Configuration
Switch# show interfaces fastethernet 1/0/46 switchport
Name: Fa1/0/46 Switchport: Enabled Administrative Mode: dynamic auto Operational Mode: trunk
Administrative Trunking Encapsulation: negotiate Negotiation of Trunking: On Access Mode VLAN: 1 (default) Trunking Native Mode VLAN: 1 (default) Administrative Native VLAN tagging: enabled Voice VLAN: none
Administrative private-vlan host-association: none Administrative private-vlan mapping: none Administrative private-vlan trunk native VLAN: none Administrative private-vlan trunk Native VLAN tagging: enabled Administrative private-vlan trunk encapsulation: dotlq Administrative private-vlan trunk normal VLANs: none Administrative private-vlan trunk private VLANs: none Operational private-vlan: none
Example 16-4 Displaying the Default Switch Port Configuration (Continued)
Trunking VLANs Enabled: ALL Pruning VLANs Enabled: 2-1001
Capture Mode Disabled Capture VLANs Allowed: ALL Protected: false
Unknown unicast blocked: disabled Unknown multicast blocked: disabled Appliance trust: none Switch#
The solution to this situation is to configure every switch port to have an expected and controlled behavior. For example, instead of leaving an end-user switch port set to use DTP in auto mode, configure it to static access mode with the following commands:
Switch(config)# interface type mod/num Switch(config-if)# switchport access vlan vlan-id Switch(config-if)# switchport mode access
This way, an end user never will be able to send any type of spoofed traffic that will make the switch port begin trunking.
In addition, you might be wise to disable any unused switch ports to prevent someone from discovering a live port that might be exploited.
Continue reading here: WLAN Building Blocks
Was this article helpful?