Switch Security Best Practices for Unused and User Ports

Last Updated on Tue, 25 Jun 2024 | Routing and Switching

The first three items in the list of best practices for unused and user ports are mostly covered in earlier chapters. For a brief review, Example 21-7 shows an example configuration on a Cisco 3550 switch, with each of these items configured and noted. In this example, fa0/1 is a currently unused port. CDP has been disabled on the interface, but it remains enabled globally, on the presumption that some ports still need CDP enabled. DTP has been disabled as well, and STP Root Guard and BPDU Guard are enabled.

Example 21-7 Disabling CDP and DTP and Enabling Root Guard and BPDU Guard

! The cdp run command keeps CDP enabled globally, but it has been disabled on ! fa0/1, the unused port. cdp run int fa0/0 no cdp enable

! The switchport mode access interface subcommand prevents the port from trunking, ! and the switchport nonegotiate command prevents any DTP messages ! from being sent or processed. switchport mode access switchport nonegotiate

! The last two interface commands enable Root Guard and BPDU Guard, per interface, ! respectively. BPDU Guard can also be enabled for all ports with PortFast ! enabled by configuring the spanning-tree portfast bpduguard enable global ! command.

spanning-tree guard root spanning-tree bpduguard enable

Port Security

Switch port security monitors a port to restrict the number of MAC addresses associated with that port in the Layer 2 switching table. It can also enforce a restriction for only certain MAC addresses to be reachable out the port.

To implement port security, the switch adds more logic to its normal process of examining incoming frames. Instead of automatically adding a Layer 2 switching table entry for the source MAC and port number, the switch considers the port security configuration and whether it allows that entry. By preventing MACs from being added to the switch table, port security can prevent the switch from forwarding frames to those MACs on a port.

Port security supports the following key features:

KEY ■ Limiting the number of MACs that can be associated with the port POINT

■ Limiting the actual MAC addresses associated with the port, based on three methods:

— Static configuration of the allowed MAC addresses

— Dynamic learning of MAC addresses, up to the defined maximum, where dynamic entries are lost upon reload

— Dynamically learning but with the switch saving those entries in the configuration (called sticky learning)

Port security protects against a couple of types of attacks. Once a switch's forwarding table fills, the switch times out older entries. When the switch receives frames destined for those MACs that are no longer in the table, the switch floods the frames out all ports. An attacker could cause the switch to fill its switching table by sending lots of frames, each with a different source MAC, forcing the switch to time out the entries for most or all of the legitimate hosts. As a result, the switch floods legitimate frames because the destination MACs are no longer in the CAM, allowing the attacker to see all the frames.

An attacker could also claim to be the same MAC address as a legitimate user by simply sending a frame with that same MAC address. As a result, the switch would update its switching table, and send frames to the attacker, as shown in Figure 21-2.

Figure 21-2 Claiming to Use Another Host's MAC Address

KEY POINT

PC-A

IP-A

MAC-A

Figure 21-2 Claiming to Use Another Host's MAC Address

PC-A

IP-A

MAC-A

PC-B

IP-B

MAC-B

1. Attacker sources frame using PC-B's actual MAC.

2. SW1 updates its MAC address table.

3. Another frame is sent to destination MAC-B.

4. SW1 forwards frame to attacker.

PC-B

IP-B

MAC-B

1. Attacker sources frame using PC-B's actual MAC.

2. SW1 updates its MAC address table.

3. Another frame is sent to destination MAC-B.

4. SW1 forwards frame to attacker.

Port security prevents both styles of these attacks by limiting the number of MAC addresses and by limiting MACs to particular ports. Port security configuration requires just a few configuration steps, all in interface mode. The commands are summarized in Table 21-4.

Table 21-4 Port Security Configuration Commands

Table 21-4 Port Security Configuration Commands

KEY POINT

Command

Purpose

switchport mode {access | trunk}

Port security requires that the port be statically set as either access or trunking

switchport port-security [maximum value]

Enables port security on an interface, and optionally defines the number of allowed MAC addresses on the port (default 1)

switchport port-security mac-address mac-address [vlan {vlan-id | {access | voice}}

Statically defines an allowed MAC address, for a particular VLAN (if trunking), and for either the access or voice VLAN

KEY POINT

Table 21-4 Port Security Configuration Commands (Continued)

Command

Purpose

switchport port-security mac-address sticky

Tells the switch to remember the dynamically learned MAC addresses

switchport port-security [aging] [violation {protect | restrict | shutdown}]

Defines the Aging timer and actions taken when a violation occurs

Of the commands in Table 21-4, only the first two are required for port security. With just those two commands, a port allows the first-learned MAC address to be used, but no others. If that MAC address times out of the CAM, another MAC address may be learned on that port, but only one is allowed at a time.

The next two commands in the table allow for the definition of MAC addresses. The third command statically defines the permitted MAC addresses, and the fourth command allows for sticky learning. Sticky learning tells the switch to learn the MACs dynamically, but then add the MACs to the running configuration. This allows port security to be enabled and existing MAC addresses to be learned, but then have them locked into the configuration as static entries simply by saving the running configuration. (Note that the switchport port-security maximum x command would be required to allow more than one MAC address, with x being the maximum number.)

The last command in the table tells the switch what to do when violations occur. The protect option simply tells the switch to perform port security. The restrict option tells it to also send SNMP traps and issue log messages regarding the violation. Finally, the shutdown option puts the port in a err-disabled state, and requires a shutdown/no shutdown combination on the port to recover the port's forwarding state.

Example 21-8 shows a sample configuration, based on Figure 21-3. In the figure, Server 1 and Server 2 are the only devices that should ever be connected to interfaces Fast Ethernet 0/1 and 0/2, respectively. In this case, a rogue device has attempted to connect to fa0/1.

Figure 21-3 Port Security Configuration Example

Fa0/1 Server 1

-' 0200.1111.1111

Fa0/2 Server 2

' 0200.2222.2222

Fa0/3 Company

- Comptroller

Fa0/4

- User1

Example 21-8 Using Port Security to Define Correct MAC Addresses Connected to Particular Interfaces

! FA0/1 has been configured to use a static MAC address, defaulting to allow ! only one MAC address, interface FastEthernet0/1 switchport mode access switchport port-security switchport port-security mac-address 0200.1111.1111

! FA0/2 has been configured to use a sticky-learned MAC address, defaulting to ! allow only one MAC address.

interface FastEthernet0/2 switchport mode access switchport port-security switchport port-security mac-address sticky fred# show port-security interface fastEthernet 0/1

Port Security : Enabled Port status : Err-Disabled Violation mode : Shutdown Maximum MAC Addresses : 1 Total MAC Addresses : 1

Aging time : 0 mins

Aging type : Absolute

SecureStatic address aging : Disabled

Aging time : 0 mins

Aging type : Absolute

SecureStatic address aging : Disabled fred# show port-security interface fastEthernet 0/2

Port Security : Enabled

Port status : SecureUp

Violation mode : Shutdown

Maximum MAC Addresses : 1

Total MAC Addresses : 1

Configured MAC Addresses : 0

Sticky MAC Addresses : 1

Aging time : 0 mins

Aging type : Absolute

SecureStatic address aging : Disabled

Security Violation count : 0

! Note the updated configuration in the switch. Due to the sticky option, the ! switch added the last shown configuration command.

KEY POINT

Example 21-8 Using Port Security to Define Correct MAC Addresses Connected to Particular Interfaces (Continued)

Fred# show running-config (Lines omitted for brevity) interface FastEthernet0/2 switchport mode access switchport port-security switchport port-security mac-address sticky switchport port-security mac-address sticky 0200.2222.2222

The final part of the example shows that sticky learning updated the running configuration. The MAC address is stored in the running configuration, but it is stored in a command that also uses the sticky keyword, differentiating it from a truly statically configured MAC. Note that the switch does not automatically save the configuration in the startup-config file.

Dynamic ARP Inspection

A switch can use DAI to prevent certain types of attacks that leverage the use of IP ARP messages. To appreciate just how those attacks work, you need to keep in mind several detailed points about the contents of ARP messages. Figure 21-4 shows a simple example with the appropriate usage of ARP messages, with PC-A finding PC-B's MAC address.

Figure 21-4 Normal Use of ARP, Including Ethernet Addresses and ARP Fields

KEY POINT

ARP Request

Eth. Header ARP Message

ARP Reply

Eth. Header ARP Message

Figure 21-4 Normal Use of ARP, Including Ethernet Addresses and ARP Fields

KEY POINT

ARP Request

Eth. Header ARP Message

ARP Reply

Eth. Header ARP Message

SRC

= MAC-A

SRC

= MAC-A, SRC = IP-A

SRC

= MAC-B

SRC

= MAC-B, SRC

= IP-B

DST

= b'cast

TRG

= ???, TRG = IP-B

©

DST

= MAC-A

TRG

= MAC-A, TRG

IP-A

MAC-A

PC-B

IP-B

MAC-B

PC-A

IP-A

MAC-A

PC-B

IP-B

MAC-B

Attacker

PC-C

MAC-C

1. PC-A Sends ARP Broadcast Looking for IP-B's MAC Address (Target MAC)

2. PC-B Sends LAN Unicast ARP Reply

The ARP message itself does not include an IP header. However, it does include four important addressing fields: the source MAC and IP address of the sender of the message, and the target MAC and IP address. For an ARP request, the target IP lists the IP address whose MAC needs to be found, and the target MAC Address field is empty, as that is the missing information. Note that the ARP reply (a LAN unicast) uses the source MAC field to imply the MAC address value—for example, PC-B sets the source MAC inside the ARP message to its own MAC address, and the source IP to its own IP address.

An attacker can form a man-in-the-middle attack in a LAN by creative use of gratuitous ARPs. A gratuitous ARP occurs when a host sends an ARP reply, without even seeing an ARP request, and with a broadcast destination Ethernet address. The more typical ARP reply in Figure 21-4 shows the ARP reply as a unicast, meaning that only the host that sent the request will learn an ARP entry; by broadcasting the gratuitous ARP, all hosts on the LAN will learn an ARP entry.

While gratuitous ARPs can be used to good effect, they can also be used by an attacker. The attacker can send a gratuitous ARP, claiming to be an IP address of a legitimate host. All the hosts in the subnet (including routers and switches) update their ARP tables, pointing to the attacker's MAC address—and then later sending frames to the attacker instead of to the true host. Figure 21-5 depicts the process.

Figure 21-5 Man-in-the-Middle Attack Using Gratuitous ARPs

KEY POINT

PC-A ARP Table

SW1 Forwarding Table

Figure 21-5 Man-in-the-Middle Attack Using Gratuitous ARPs

PC-A ARP Table

IP Address

MAC

IP-B

MAC-B MAC-C

SW1 Forwarding Table

Address

Port

MAC-B

Fa0/2

MAC-C

IP-B

MAC-C

IP-B

Attacker

PC-C

MAC-C

© ARP Reply (Gratuitous) Eth. Header ARP Message

Attacker

PC-C

MAC-C

© ARP Reply (Gratuitous) Eth. Header ARP Message

SRC =

MAC-C

SRC

= MAC-C, SRC

= IP-B

DST =

B'cast

TRG

= MAC-A, TRG

= IP-A

The steps shown in Figure 21-5 can be explained as follows:

1. The attacker broadcasts gratuitous ARP listing IP-B, but with MAC-C as the source IP and MAC.

2. PC-A updates its ARP table to list IP-B's associated address as MAC-C.

3. PC-A sends a frame to IP-B, but with destination MAC MAC-C.

4. SW1 forwards the frame to MAC-C, which is the attacker.

The attack results in other hosts, like PC-A, sending frames meant for IP-B to MAC address MAC-C—the attacker's PC. The attacker then simply forwards another copy of each frame to

PC-B, becoming a man in the middle. As a result, the user can continue to work, and the attacker can gain a much larger amount of data.

Switches use DAI to defeat ARP attacks by examining the ARP messages and then filtering inappropriate messages. DAI considers each switch port to be either untrusted (the default) or trusted, performing DAI messages only on untrusted ports. DAI examines each ARP request or reply (on untrusted ports) to decide if it is inappropriate; if inappropriate, the switch filters the ARP message. DAI determines if an ARP message is inappropriate by using the following logic:

KEY 1. If an ARP reply lists a source IP address that was not DHCP-assigned to a device off that port, POINT DAI filters the ARP reply.

2. DAI uses additional logic like Step 1, but uses a list of statically defined IP/MAC address combinations for comparison.

3. For a received ARP reply, DAI compares the source MAC address in the Ethernet header to the source MAC address in the ARP message. These MACs should be equal in normal ARP replies; if they are not, DAI filters the ARP message.

4. Like Step 3, but DAI compares the destination Ethernet MAC and the target MAC listed in the ARP body.

5. DAI checks for unexpected IP addresses listed in the ARP message, such as 0.0.0.0, 255.255.255.255, multicasts, and so on.

Table 21-5 lists the key Cisco 3550 switch commands used to enable DAI. DAI must first be enabled globally. At that point, all ports are considered to be untrusted by DAI. Some ports, particularly ports connected to devices in secure areas (ports connecting servers, other switches, and so on), need to be explicitly configured as trusted. Then, additional configuration is required to enable the different logic options. For example, DHCP snooping needs to be enabled before DAI can use the DHCP snooping binding database to perform the logic in Step 1 in the preceding list. Optionally, you can configure static IP addresses, or perform additional validation (per the last three points in the preceding list) using the ip arp inspection validate command.

Table 21-5 Cisco IOS Switch Dynamic ARP Inspection Commands

Command

Purpose

ip arp inspection vlan vlan-range

Global command to enable DAI on this switch for the specified VLANs.

[no] ip arp inspection trust

Interface subcommand that enables (with no option) or disables DAI on the interface. Defaults to enabled once the ip arp inspection global command has been configured.

ip arp inspection filter arp-acl-name vlan vlan-range [static]

Global command to refer to an ARP ACL that defines static IP/MAC addresses to be checked by DAI for that VLAN (Step 2 in the preceding list).

Related Posts

Readers' Questions

  • Helen
    What information is added to the switch table from incoming frames?
    1 year ago
    • When an incoming frame arrives at a switch, the frame's source address and the port over which it was received is added to the switch table. The switch table is a mapping of MAC addresses and the ports that frames are received on. The switch then forwards the frame to the appropriate port based on the information found in its switch table.
    Table 21-5 Cisco IOS Switch Dynamic ARP Inspection Commands (Continued)

    Command

    Purpose

    ip arp inspection validate {[src-mac] [dst-mac] [ip]}

    Enables additional optional checking of ARP messages (per Steps 3-5 in the preceding list).

    ip arp inspection limit {ratepps [burst interval seconds] | none}

    Limits the ARP message rate to prevent DoS attacks carried out by sending a large number or ARPs.

    Because DAI causes the switch to perform more work, an attacker could attempt a DoS attack on a switch by sending large numbers of ARP messages. DAI automatically sets a limit of 15 ARP messages per port per second to mitigate that risk; the settings can be changed using the ip arp inspection limit interface subcommand.

    DHCP Snooping

    DHCP snooping prevents the damage inflicted by several attacks that use DHCP. DHCP snooping causes a switch to examine DHCP messages and filter those considered to be inappropriate. DHCP snooping also builds a table of IP address and port mappings, based on legitimate DHCP messages, called the DHCP snooping binding table. The DHCP snooping binding table can then be used by DAI and by the IP Source Guard feature.

    Figure 21-6 shows a man-in-the-middle attack that leverages DHCP. The legitimate DHCP server sits at the main site, whereas the attacker sits on the local LAN, acting as a DHCP server.

    Figure 21-6 Man-in-the-Middle Attack Using DHCP

    KEY Web Server DHCP Server

    POINT

    Continue reading here: IP Access Control List Review

    Was this article helpful?

    0 0