Hello and welcome back.
If you and I were going out to a job site to do some work
and we had some tools that we were going to bring with us,
we'd want to make sure, before we go,
that we brought all our tools.
So we'd want to do a quick inventory.
And in this video, that's what I'd like to do
is a quick inventory of many of the Layer 2 security tools
that we have to work with in a Cisco Network.
And let's use this network topology
as a backdrop for this discussion.
And let's imagine that you and I are consultants
and we're going into a customer and they're
asking us, "OK, if we hire you, what
are some of the things you're going to consider WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
are some of the things you're going to consider
regarding security at Layer 2?"
Now together, let's make a list of some of those things
that we should consider.
So let's start with some basics.
One of the basic things we're going
to want to do for security is network segmentation
at the VLAN level.
And so with every Layer 2 VLAN, there's
also a Layer 3 associated IP network.
And then we can control access between those networks
with firewalls or routers between them.
But we can also go one step further
and use a technology such as TrustSec, which is fabulous.
And that allows two devices.
Even if they're in the same VLAN,
we can control the traffic back and forth WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
we can control the traffic back and forth
between those two devices based on our TrustSec configuration,
which, in the background, is going
to involve Identity Services Engine and then
policies that drive all that.
And the concept here is segmentation,
or in the case of TrustSec, micro-segmentation
within a VLAN.
Another Layer 2 security option would be DHCP snooping.
And that way if Bob, on this computer, plugs in
and he's running some malicious software
or he brings a little home router
and plugs it in that tries to become a DHCP server,
by just doing DHCP snooping in these VLANs,
the server's messages, like Offers and Acknowledgements, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
the server's messages, like Offers and Acknowledgements,
won't be allowed in unless that's a DHCP snooping
trusted port, which by default, if we've been able to feature,
it's not.
Another tool that we can leverage DHCP snooping
in the database it builds would be Dynamic ARP Inspection.
And that just makes sure that nobody
is lying about their Layer 3 to Layer
2 mappings in ARP messages.
So anything that is bogus, we can drop right
at the edge of the switch, and it
doesn't get into the network to muck
with or manipulate somebody else.
And we can also do the classic of port security, which WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And we can also do the classic of port security, which
can control how many MAC addresses can we
learn on an individual port.
We can also hard code what those addresses are.
And with port security, we can specify
what those MAC addresses are, and then
any device that has a different Layer 2 address
won't be allowed to send frames in because of port security.
Also, on switches, we can also have access control lists
on switches.
As a general precaution at Layer 2,
we'd also want to disable DTP, Dynamic Trunk
Protocol and any unused ports.
In fact, the default behavior, what we should do
is set up all of our ports as access ports to a bogus VLAN. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
is set up all of our ports as access ports to a bogus VLAN.
And that way, if that port isn't being configured
for use, an attacker, or somebody
else who connects to that port, gets access
to virtually nowhere.
And because it's an access port, it's not willing to trunk.
So that's a quick review of a few of the Layer 2 security
options.
And what I'd like to do further in this set of videos
is talk about a couple more, including
storm control and a couple of Spanning Tree Protocol
protections.
And that would include, among other things, root guard
and BPDU guard.
And as we continue through this set of videos,
we're going to elaborate more on those as well. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
we're going to elaborate more on those as well.
So I'll see you in the next video
as we continue this discussion about how
we can protect our environment at Layer 2
on our Catalyst switches.
I'll see you in the next video.
Meanwhile, I hope this has been informative for you.
And I'd like to thank you for viewing.