In network security, the “Access Layer” is often the most vulnerable because it is where end-users and their devices physically connect to the infrastructure. As noted in the sources, Layer 2 is frequently where attacks begin, making it critical to harden these entry points.

This guide breaks down the steps to secure a switch port against common threats like MAC flooding, rogue DHCP servers, and Man-in-the-Middle (MitM) attacks.

1. Implementing Port Security

The first step in securing an access port is to control which devices are allowed to communicate through it.

• Enable Port Security: You must explicitly turn on port security on the specific access port.
• Limit MAC Addresses: By limiting the port to two MAC addresses, you prevent a single port from being used to overwhelm the switch’s memory.
  • Example: This allows for a workstation and a VoIP phone to be connected to the same port while blocking any additional unauthorized devices.
• Set Violation Mode to “Restrict”: In the event an unauthorized device is plugged in, the “restrict” mode will drop packets from the unknown MAC address and increment a security violation counter without shutting down the entire port.
• Use Sticky Learning: This feature allows the switch to “remember” the MAC addresses of legitimate devices currently connected and automatically add them to the configuration. This ensures that even after a reboot, only those specific devices are permitted.

2. Defending Against Rogue DHCP Servers

A common internal threat is the introduction of a rogue DHCP server, which can hand out incorrect IP addresses or point users to a malicious gateway.

• DHCP Snooping: By enabling DHCP snooping on the VLAN, the switch begins to distinguish between “trusted” and “untrusted” sources of DHCP messages.
• The Trusted Uplink: You must specifically mark the uplink to your legitimate DHCP server as “trusted”. All other ports (where users are) remain untrusted, meaning the switch will block any DHCP “offer” or “acknowledgment” messages coming from them.

3. Preventing Man-in-the-Middle (MitM) Attacks

ARP Spoofing is a technique where an attacker sends fake ARP messages to link their MAC address with the IP address of a legitimate server or gateway, allowing them to intercept traffic.

• Dynamic ARP Inspection (DAI): Enabling DAI stops ARP spoofing by intercepting all ARP requests and responses on untrusted ports.
• Verification: The switch uses the binding table created by DHCP snooping to verify that the ARP packet’s information is legitimate. Like DHCP snooping, the uplink to the rest of the network should be marked as trusted for DAI to allow legitimate traffic flow.

Final Step: Save Your Configuration

Once these layers of defense are active, your port is significantly more resilient against MAC flooding and MitM attempts. To ensure these settings persist after a system restart, always remember to write memory.

By following these steps, you transform a standard access port into a hardened gateway that actively protects the integrity of your network.