Layer 2 Security Best Practices

Here are a couple of recommendations from Cisco when it comes to securing layer 2

• STP - Leverage Root Guard and BPDU Guard
• Shutdown unused ports
• Leverage DHCP snooping and DAI (Dynamic Arp Inspection)
• Disable unneeded services
• Use port security to restrict the number of MAC addresses that a port can learn
• Limit management access to a layer 2 switch
• Use SNMPv3
• Do not use the native VLAN to send user data. Create a native VLAN and do not add any ports to it.

This was not mentioned but I would also add PVLAN (Private VLANs) and VACL's where appropriate.

Best Practices Part 1 - Layer 2 Spanning-Tree

The topology depicted in the diagrams is used to help demonstrate data flow during failure and to provide discussion around best practices and may not be necessarily be configured as optimal as possible. I will provide examples in a series of blogs that will provide alternate technical solutions that follow best practice guidelines.

Topology Image

Normal Data Path Flow

 Data Path Flow Root Fail

Data Path Flow-Access Trunk Fail

Data Path Flow Router Fail

Spanning-Tree mode Rapid-PVST (802.1w) or MST (802.1s) - I will show more about load balancing techniques leveraging each of these technologies in "Layer 2 Spanning-Tree Best Practices Part-2" Deterministic blocked ports - in this example we know exactly which ports are going to be blocked by STP. All redundant connections to the secondary root bridge will be blocked. Cisco also recommends that you do not exceed STP diameter of seven hops. Ensure that you hard configure your Root and Secondary Root bridges. Ensure that you only allow required VLAN's over the trunks to ensure you are not running unnecessary STP instances.

Features to leverage include:
Access Layer
-portfast
-bdpuguard
-disable DTP
-loopguard
-etherchannel Guard

Distribution Layer
-root and secondary root placement
-root guard
-disable DTP
-etherchannel Guard

Leverage EtherChannel to reduce the number of ports that need to transition from blocking to forwarding state when leveraging multiple links.

EtherChannel Ports
-EtherChannel Guard

Quick Notes - IRB - IEEE

BBBB must be able to connect to AAAA and vice versa. Layer2 must be used on hub and AAAA/BBBB must leverage layer 3 ports on the directly connected interface.

Quick Notes - Layer2 MISC

Layer2 MISC

Loop Guard - Prevents alternate port and root ports from becoming designated ports. IF BPDUs are not received on a NON-DP port then the port is moved into err-disabled state
Global config - "spanning-tree loopguard default"

UDLD - Unidirectional Link Detection
- Both sides need to be configured
- default setting is disabled on copper ports and enabled on fibre ports
Enable on copper ports, interface config - udld enable

Root Guard
- the port that has root guard enabled ensures that if a superior BPDU is received the port is put into "root inconsistent state"
Interface config - "spanning-tree guard root"

BPDU Guard
- Ensures that loops are not formed on ports that are enabled to use portfast, if BPDU is recieved the port is put into error disabled state. Two ways to enable BPDU Guard
Global config - "spanning-tree portfast bpduguard" - All ports that have portfast enabled will also have BPDU guard enabled
Interface config - spanning-tree bpduguard enable"

BPDU Filter
- When enabled globally and a BPDU is received on a port the is enabled with portfast the port loses it portfast status
Global config - "spanning-tree portfast bpdufilter default
-when enabled on the interface the port stops sending and recieveing BPDU. This is dangerous as a loop can form
Interface config - "spanning-tree bpdufilter enable

Question 125

When would you use "pseudowire-class" command?

Question 124

Why would you use the "bba-group" command for?

Question 116

What is VMPS?

Question 107

What does "ip local-proxy-arp" accomplish?

Question 106

What command would you use to ensure a device responds to all ARP requests?

Question 73

Provide a bridging networks example?

Question 34

What protocol is an industry standard replacement of CDP?

Question 33

What is required when setting up a remote span?

Provide an example using 3 switches