>> Now that we've looked in
network connectivity devices
and we know the difference between a hub,
a switch, a router, and a VLAN,
what we'll do in the next couple of sections
is look at them more in-depth.
In this section, are going to take
>> a look at switches and VLANs
>> and configuring them in a secure environment.
>> One of the first things we'll
talk about is port mirroring.
We've talked about how a switch learns
the network over time and
switch learns what MAC address is
attached to each port and then follows ports.
The first thing we want to look at is port mirroring.
With port mirroring, this comes into
play when we have a device like a sniffer
or an intrusion detection system
that we want to bring on the network.
We've already said that switches
really learn the network and
forward traffic out only the appropriate port.
But when I have an intrusion detection system or if
I have a sniffer and I want to
evaluate the traffic on my network,
when I plug into a single port on a switch,
there really shouldn't be traffic coming
out the port because nobody who is
directing traffic specifically to
my sniffer or to my IDS.
What we want to do is enable a mode called port SPAN.
As you know, everything stands for something.
The SPAN stands for Switched Port Analyzer.
Essentially, that's an administrative mode,
which is just going to allow
the network packets to come out of a particular port.
That particular port on which I've enabled SPAN.
This is one of the ways we're going to be able to
monitor traffic on a switch network.
Like we said, switches are Layer 2 devices.
They use MAC addresses to learn the network.
They store that MAC address in
a table called the CAM table
and that's where the MAC addresses
are mapped to specific ports.
We want to consider things like
MAC flooding as a threat and what happens with
MAC flooding is the legitimate entries in
the CAM table are overwritten with
bogus entries and ultimately,
what it winds up doing is causing the switch to
forget all the ports that is learned over time.
When a switch doesn't know what
port forwarded traffic out,
it acts just like a hub
>> and since all data out all ports
>> until it learns the network again,
>> so MAC flooding is a concern.
With considering MAC addresses,
we want to perhaps add the security of requiring
a specific MAC address to connect to a specific port.
Sometimes there are flood guards you can enable
on a switch to look for things like MAC flooding.
We just want to make sure that the
>> CAM table is protected
>> because like I said when the CAM tables is overwritten,
the device turns back into being a hub,
which from the standpoint of securities is very weak.
Spanning Tree Protocol is a technique that's used to
eliminate the problem or at least
mitigate the problem of switching loops.
Many times we have switches
connected together with redundant links,
because if one link goes down,
we still want connectivity.
The problem with that is that we can
have a problem where the switches learn
the same destination IP address on multiple ports,
and that causes confusion because
the broadcast will send out
that information to the other switches,
you wind up having something called switching loop,
which can cause lots of problems and can cause
MAC table to be overwritten
and cause some conflicts there.
What Spanning Tree Protocols does is very basic.
When you have redundant links,
you can figure those links so
that one is in a state of listening,
the other is in forwarding mode.
The port that's in forwarding is sending traffic,
while the other is sitting there waiting
till the main port or forwarding port fails.
In that state, the listening ports
become active forwarding ports.
It's a way of prioritizing
one link while telling the other links to
stand down until there's
a failure and need for redundancy arises.
With VLANs, we have VLAN tagging or VLAN trunking.
This is what allows VLANs or inter-VLAN traffic
to happen on a switch.
Ultimately, if we're connecting a switch to
a router and we've got multiple VLANs on a switch,
there has to be a way for that router to
differentiate the switch to
which VLAN to send traffic to.
If you can see in this illustration,
there are a couple of different VLANs.
Remember, we're assuming
this is a Layer 2 switch based on
this diagram and a Layer 2 switch
can't allow inter-VLAN communication.
What they've done in this illustration rather,
than using a three-layer switch,
is they've connected that Layer 2 switch
to a router, and that works.
The traffic goes out to the router,
the router adds a tag,
>> and sends our packet back to the switch.
>> If it has traffic, in this illustration
for the 172.16.20 network,
it gives a tag that says VLAN 10.
If it's for the 172.16.10 network,
it gives a tag called VLAN 20,
so that a Layer 2 switch can
understand where to send traffic.
Remember, Layer 2 switches only use MAC addresses.
We have VLANs that need to communicate with each other.
They are separate IP addresses
and we have to have a Layer 3 device.
If we didn't have a Layer 3 device or a router,
then we could have used a Layer 3 switch.