>> Here are a couple of extra security measures
that we can take with our switches.
The first one is called a DHCP snooping,
and this is a feature that you can
turn on on some switches.
It's based on the idea that
the DHCP protocol is inherently insecure.
There really is no server of
authentication to make sure that the IP
addresses being assigned are
from a legitimate DHCP server.
Just like so many of our protocols,
DHCP was designed for function,
but not secure function.
So we can add on security at the switch level and have
the switch analyze the network for DHCP requests,
specifically, DHCP offers.
Hopefully narrow down the offers that come
from unauthorized DHCP servers.
We've also got flood guards,
and our switches can look for specific types
of traffic that are in excess of what's normal.
We talked a lot about denial of
service attacks or ping floods.
On switches, you can unmark floods.
There are all sorts of floods;
UDP floods, TCP floods, SYN floods.
So ultimately, looking for
an inordinate amount of traffic,
a specific type would be
what a flood guard is going to do for you.
Then x2; root guard and BPDU guard.
Both have to do with Spanning Tree Protocol.
We talked about Spanning Tree Protocol briefly,
but the whole idea is that Spanning Tree is
designed to mitigate the problems switching loops.
What Spanning Tree does,
is it creates a logical structure of
an inverted tree where
the root switch is the basis of the inverted tree.
It's the root, and all the other switches
ultimately connect through a pathway up to the root,
and then any other redundant links are disabled.
Ultimately, everything is coming up through the root.
We want to make sure that our particular route switch
is one that is capable of
handling a solid amount of switching
traffic because it's going to be very busy.
We also want to make sure that it is
guarded and that we don't have
the capability of another switch
modifying or impersonating the root.
That's where the root guard feature comes in.
Then we have BPDU guard,
which stands for Bridge Protocol Data Unit,
and this is communication that should
only go across trunking ports.
When one switch is connecting to
another switch or is connecting to a router,
we have access ports and trunking ports.
Trunking is switch to switch.
Access ports are where your client devices plug in.
We want to make sure that we don't have
BPDUs coming in on client or access ports
because that would indicate
some reconfiguring on our network environments.
So we turn BPDU Guard on with our access ports.
Also, with port security,
we can set configuration options like only allowing
certain MAC addresses or
a certain number of MAC addresses
to connect to a certain port.
That's not really high-end security
>> because MAC addresses
>> can be spoofed just like most addresses however.
It does give us one more layer of defense.
Our key takeaways;
we spent this chapter looking at switches more
deeply and we talked about the ways switches operate,
as well as some of the security concerns with switches.
We continue to focus on the fact that
switches use MAC addresses and we
have to make sure that the table in which they
store those MAC addresses is protected.
Remember, that table is called the CAM
table and we're concerned
>> with things like MAC flooding.
>> Another concern with switches is switching loops
that lead to what are referred to as broadcast storms,
and that's when all data is going out all ports on
a switch because it's gotten
confused as to where specific hosts are.
When a switch doesn't know where to send traffic,
it goes back to an operating like
a hub and all data goes out all ports all the time.
That can be caused by MAC flood.
But we can also see that as a result of
redundant links that are set up
to have additional fault tolerance.
But if they're not configured properly
with the Spanning Tree,
it can cause a lot of confusing,
making Spanning Tree very helpful.
We also talked about needing to
monitor security through our switches.
But because of how switches operate,
we need to enable port span or port mirroring on
a specific port on
the switch so that we can view all traffic.
We also discuss VLAN tagging a trunking,
which essentially is how we're going to enable
valence to spend multiple switches and
can also tag for layer 2 switches
>> that still want to have
>> VLANs and allow that inner VLAN communication.