Ccna Security Extra Points

Front 1

Some best Practices in VLAN security

Back 1

VLAN configuration: Consider the following recommendations when configuring switch VLANs:
— Configure ports that do not need to form a trunk to a trunk setting of “off,” as opposed to “auto.”
— Do not send user data over an IEEE 802.1Q trunk’s native VLAN.
— Use private VLANs to prevent an attacker from compromising one host
in a VLAN and then using that host as a jumping-off point to attack other hosts within the VLAN.

Front 2

VLAN Hopping

Back 2

A VLAN hopping attack allows traffic from one VLAN to pass into another VLAN, without
first being routed

Front 3

Switch Spoofing

Back 3

By default, Ethernet trunks on Cisco Catalyst switches carry traffic for all VLANs.
Therefore, if an attacker can persuade a switch to go into trunking mode, the attacker could then see traffic for all VLANs

Front 4

Disabling Trunking

Back 4

At the interface:

switchport mode access

Front 5

Preventing the use of DTP (Dynamic Trunking Protocol)

Back 5

At the interface:

switchport trunk encapsulation dot1q
switchport mode trunk
switchport nonegotiate

Front 6

How to avoid Double Tagging

Back 6

Create a VLAN that does not have any port and it is assigned like Native VLAN

Front 7

Setting the Native VLAN

Back 7

at the interface:

switchport trunk native vlan 400

Front 8

Two approcaches for portecting a network from STP attacks:

Back 8

Protecting with Root Guard
Protecting with BPDU Guard

Front 9

Root Guard

Back 9

If a port configured for Root Guard receives a superior BPDU, instead of believing the BPDU, the port goes into a root-inconsistent state. While a port is in the root-inconsistent state, no user data is sent across

at the interface:

spanning-tree guard root

Front 10

BPDU Guard

Back 10

It reduces the amount of time required for the port to go into forwarding state after being connected.

Because these PortFast ports are connected to end-user devices, they should never receive a BPDU. Therefore, if a port enabled for BPDU Guard receives a BPDU, the port is disabled

At the interface:

spanning-tree portfast bpduguard

Front 11

Enable proteccion agains dhcp snooping

Back 11

At global config:

ip dhcp snooping

At the interface:

ip dhcp snooping limit trust

Limit the dhcp messages:

ip dhcp snooping limit rate 3

Front 12

Dynamic ARP Inspection

Back 12

Bulid the MAC address associate with ip address obtaining from dhcp

at the interface:

ip arp inspection trust

Front 13

Configuring a SPAN Port

Back 13

At global config:

monitor session 1 source interface (name-interface)

monitor session 1 destination interface (name-interface)

Front 14

Cisco Catalyst switches support two categories of secondary VLANs

Back 14

Isolated VLANs
Community VLANs

Front 15

When a switch port security violation occurs, you can configure the switch port to respond in one of three ways:

Back 15

Protect
Restrict
Shutdown

Front 16

Ports support one of three types of secure MAC addresses:

Back 16

Static secure MAC address
Sticky secure MAC address
Dynamic secure MAC address:

Front 17

Static secure MAC address

Back 17

switchport port-security mac-address

Front 18

Sticky secure MAC address

Back 18

store MAC address-to-port
associations in their switch’s running configuration and CAM table.

Front 19

Dynamic secure MAC address

Back 19

dynamic secure MAC addresses are stored only in a switch’s CAM table, not in a switch’s running configuration.

Front 20

Enable port security

Back 20

switchport port-security

Front 21

Cisco Network Admission
Control (NAC)

Back 21

To ensure that every endpoint complies with network security policies before being granted access to the network,

Noncompliant is set in qurantine or given restricted access to resources