Ccsp Snrs - L2 Security - Mitigating L2 Attacks

Front 1

What type of L2 Attacks are there?

Back 1

CAM Overflow; VLAN hopping; MAC spoofing; Private VLAN Attacks; DHCP Attacks; STP Manipulation

Front 2

What is the CAM Table?

Back 2

Context-Addressable Memory (CAM) Table; cisco switches create a HASH of the 63 bit source (MAC, VLAN, etc) and store in table; entries expire after 5 minutes default

Front 3

How does a CAM Attack Work?

Back 3

An attacker connects to a switch port and sends out traffic from thousands of MAC addresses, filling the table. Eventually the table fills and switches begin flooding traffic; common tool is Macof (155,000 entries/minute)

Front 4

What technology mitigates CAM Overflow attacks?

Back 4

Port Security - used to control how MACs are learned on a switch port. Default is to shutdown interface if too many MACs are detected

Front 5

What port types does Cisco recommend using port security on?

Back 5

static access - switchport mode access

Front 6

What does it mean when a switch learns MACs sticky"?"

Back 6

They are stored in the configuration so they don't need to be relearned on reboot

Front 7

How do you configure port security?

Back 7

Int fa1/1 switchport port-security switchport port-security maximum 3 switchport port-security mac-address sticky switchport port-security mac-address 0016.1234.4565 switchport port-security violation protect

Front 8

How can you reenable a port that is in error-disable state?

Back 8

shutdown/no shutdown or errdisable recovery cause psecure-violation

Front 9

What 3 types of actions can a switch take on a port in violation of security restrictions?

Back 9

Protect - frames with unknown MACs are dropped, no notification; Restrict - unknown frames dropped, SNMP and syslog messages, and violation counter increases; Shutdown - interface to error-disabled, LED off, SNMP trap, syslog, and violation counter increases

Front 10

Can you configure port security on trunks?

Back 10

On some platforms, but not recommended due to results across VLANs

Front 11

What is VLAN hopping?

Back 11

When a user gains access to a VLAN that is not configured on their switchport

Front 12

What two techniques are used in VLAN hopping attacks?

Back 12

Trunking to the switch and double tagging

Front 13

How do you prevent VLAN hopping attacks?

Back 13

Configure ports as access ports, disable unused ports, configure access ports as the default

Front 14

Describe the MAC Spoofing attack?

Back 14

Attacker spoofs their MAC address to create a man-in-the-middle attack. Pretend to be default gateway by sending out GARP messages as the default gateway address. Then forward traffic to the correct gateway

Front 15

How can you prevent a MAC Spoofing attack?

Back 15

port security with single MAC addresses. Though the support of this configuration is often more difficult than the risk of the attack would justify. Other techniques include: holddown timers for ARP cache; private vlans; dynamic ARP inspection (DAI) and dhcp snooping

Front 16

What are Private VLAN used for?

Back 16

Further isolating a VLAN when hosts on the VLAN don't need to communicate with each other. Ports are isolated, community, or promiscuous ports. Common in DMZs

Front 17

How are Private VLAN attacks accomplished?

Back 17

The attacker in a limited port sends a packet to the router with the source ip and mac of itself, the dest mac of the router, and the dest IP of the target. The router rewrites and forwards on

Front 18

How do you defend against Private VLAN attacks?

Back 18

ACLs on routers that limit traffic back to source network

Front 19

What are the two types of DHCP attacks?

Back 19

DHCP spoofing and DHCP starvation attacks

Front 20

Describe the DHCP spoofing?

Back 20

An attacker configures a rogue DHCP server on the network to issue addresses to clients to force them to use their DNS, WINS, and Gateways

Front 21

Describe DHCP starvation?

Back 21

The attacker floods the DHCP server with DHCP requests to use all available addresses. This results in a DoS attack.

Front 22

How do you prevent DHCP attacks?

Back 22

DHCP Snooping

Front 23

How does DHCP Snooping work?

Back 23

Ports are either defined as trusted or untrusted. Only trusted ports can send DHCP offer and DHCP acknowledge packets; uses the DHCP snooping binding table;

Front 24

How do you configured DHCP Snooping?

Back 24

conf t ip dhcp snooping < global enable ip dhcp snooping vlan 10 < what VLAN onip dhcp snooping information option < use opt 82 for relay info int Gig 0/1 ip dhcp snooping trust < config port ip dhcp snooping limit rate 70 < limit to 70 pack per sec

Front 25

Describe STP Attacks

Back 25

Occur when an attacker spoofs being a switch with a lower priority in effort to become root bridge or change topology somehow. Can allow attacker to see all frames, or a DoS attack through the 30/45 sec recalculation of STP

Front 26

How do you prevent STP Attacks?

Back 26

root guard and BPDU guard

Front 27

How do you configure STP mitigation techniques

Back 27

conf t spanning-tree portfast bpduguard int fa0/10 spanning-tree guard root

Front 28

What is DAI?

Back 28

Dynamic ARP Inspection

Front 29

How does DAI determine whether an ARP packet is valid?

Back 29

Using the DHCP snooping binding table and ARP ACLs

Front 30

Where are trusted DAI interfaces typially connected to?

Back 30

other switches

Front 31

How do you configure DAI for an interface?

Back 31

conf t ip arp inspection vlan 34 ip arp inspection log-buffer entries 64 int fa0/0 ip arp inspection trust ip arp inspection limit rate 20 burst interval 2 

Front 32

How do you configure ARP ACLs?

Back 32

ip arp inspection filter global config command

Front 33

What is IP source gaurd?

Back 33

denies traffic on interface until an IP is applied by DHCP to the host, then an ACL is configured on the interface

Front 34

What type of EAP attacks are there?

Back 34

Man in the middle and session-hijacking

Front 35

How can you remove dynamic and sticky MAC addresses from the port security tables?

Back 35

clear port-security sticky MACADDRESS clear port-security sticky INTERFACE clear port-security dynamic MACADDRSSS

Front 36

How can you configure aging on port-security ports?

Back 36

switchport port-security aging {static / time TIME / type {absolute /inactivity}}

Front 37

What commands can you use to verify port-security?

Back 37

show port-security show port-security interface INTERFACE show port-security interface INTERFACE address

Front 38

What commands can you use to verify dhcp snooping?

Back 38

sh ip dhcp snooping sh ip dhcp snooping binding [ADDRESS]