16 - Campus Security - STP Attacks and Other Security Considerations

Alot of this i already covered in the CCNA-S exam, so some brief notes:

there is nothing to stop someone bring in there own switch and becoming root bridge of the network,

so we have 2 major features:

any port set for port-fast, should be set as bpdu-guard - if it detects a bpdu

it will shut down the port (as we have declard this a port-fast ie a host, there shold

not be any bpdu's)

To enable this:

inter fas0/1

spanning-tree bpduguard enable

enable same way as you would any port-security feat ..... shut, no shut

Also have a system for the good ports - to prevent a mis-configured switch from becoming the root.

We can enable root-guard

on any port connected to a switch that is NOT to become a root, this feature you would

only enable on the root switch and/or backup root switch.

inter fa0/2

spanning-tree guard root

means there will never be a switch that connects to this port, will ever become the root

but when it shuts down a port it doesn't go into err-disable, it becomes a inconstant port

17 - Campus Security - VACLs

VACL - can also redirect traffic! - more common use for using vacl

3550

only allow you to permit and deny, whereas the 6500

it could:

match this subnet and redirect it to an IPS sensor/blade etc

vlan 10

vlan 30

very similar to route-maps .... sequencing etc

access-list 10

permit 10.1.10.0 0.0.0.255

mac access-list extended SERVER

permit any host 1111.1111.2222

access-list 30

permit 10.1.30.0 0.0.0.255

vlan access-map <NAME> demo <seq number>

match ip address 10

action forward

vlan access-map demo 20

action drop

As you can see very simialar to route-map (match and set etc)

NOW TO APPLY IT

vlan filter demo vlan-list 10 (can use - or commons etc)

vlan access-map demo1 10

match ip address 30

action forward

vlan access-map demo1 20

action drop

vlan filter demo1 vlan-list 30 

SO as you can see, its a simple demo, BUT you can use extended access-lists and combine

them all together in the vlan access-maps

PACLs

access-list applied to a port (Layer2, ie no no switchport, otherwise its just an ACL on a port)

can only be applied inbound (like the asic of the switch)

int fa0/3

ip access-group 1 in

or do mac access-group <name> in