L2 Security
Mitigation = countering security risks. At L2 that starts with securing the switches themselves, followed by the specific countermeasures per attack type.
Securing Switch Management
The starting point before you even think about specific mitigations:
- Always use the secure variants of management protocols: SSH, SCP, SFTP, SSL/TLS — never Telnet or HTTP
- Consider out-of-band management — management via a separate channel that doesn't coincide with the production links
- Use a dedicated management VLAN — only management traffic runs over it
- Use ACLs to filter out unwanted traffic to management interfaces
Mitigation Overview
| Solution | Protects against |
|---|---|
| Port Security | MAC flooding, DHCP starvation |
| DHCP Snooping | DHCP starvation, DHCP spoofing |
| Dynamic ARP Inspection (DAI) | ARP spoofing, ARP poisoning |
| IP Source Guard (IPSG) | MAC spoofing, IP spoofing |
| BPDU Guard | STP attacks |
Port Security
Limits the number of source MAC addresses a switch is allowed to learn on a port. If a port exceeds the configured maximum, or a disallowed MAC address connects, the port goes into an error state.
3 violation modes:
| Mode | Behavior on violation |
|---|---|
| Shutdown | The port immediately goes into err-disabled state — requires manual re-activation |
| Protect | Frames from unknown MAC addresses are dropped, no notification |
| Restrict | Frames are dropped + SNMP trap + syslog notification |
Port Security also addresses DHCP starvation, because the attack depends on forwarding frames with varying source MAC addresses.
DHCP Snooping
DHCP Snooping acts as a filter on switch ports for DHCP messages.
- Ports are classified as trusted or untrusted
- Only trusted ports may pass DHCP Offer and Acknowledge messages
- Untrusted ports (access ports facing clients) may only send DHCP Discover and Request
- A rogue DHCP server on an untrusted port is thereby blocked
DHCP Snooping also builds a binding table: IP → MAC → VLAN → port → lease time. That binding table is the basis for DAI and IPSG.
Dynamic ARP Inspection (DAI)
DAI intercepts ARP messages on untrusted ports and compares them against the DHCP Snooping binding table.
- If the IP-MAC pair in the ARP message doesn't match the binding table → the frame is dropped
- If it does match → the frame is passed
- Trusted ports (uplinks) are not inspected
Requires DHCP Snooping to be active (for the binding table). Devices with a static IP can also be added manually to the binding table via ARP ACLs.
IP Source Guard (IPSG)
Filters IP and/or MAC addresses on untrusted ports based on the DHCP Snooping binding table.
- Only packets that match a binding (IP + MAC + port + VLAN) are passed
- All other packets are dropped
- Protects against address spoofing: an attacker taking over an existing IP or MAC is blocked because their port isn't in the binding
BPDU Guard
Protects STP against attacks via forged BPDU messages. BPDU Guard is configured on access ports — if a BPDU arrives on such a port (which should only ever come from another switch), the port immediately goes into err-disabled.
Works together with PortFast: ports with PortFast enabled are typically the candidates for BPDU Guard.