Core: Security

Layer 2 security

Miro Kosut

Miro Kosut

— 2 min read
Share

Requirement / business driver

Close the access-edge attack surface - L2 is where untrusted hosts plug in, and most L2 attacks are cheap and local.

The toolkit (apply at the access edge)

  • DHCP snooping - trust only legitimate DHCP servers; builds the binding table the next two tools use.
  • Dynamic ARP Inspection (DAI) - block ARP spoofing / MITM using the snooping table.
  • IP Source Guard / IPDT - permit only the snooped IP/MAC on a port (anti-spoofing).
  • Port security - cap MACs per port (stop MAC flooding / rogue hubs).
  • STP security - BPDU Guard / Root Guard (Spanning Tree - types, tuning, and loop mitigation) so an edge port can't influence the tree.
  • VACL - filter within a VLAN.
  • IPv6 first-hop security - RA Guard (block rogue Router Advertisements), DHCPv6 Guard, ND inspection - the v6 equivalents of DHCP snooping/DAI.

The v6 first-hop set is one system, not a feature list: IPv6 snooping inspects ND and DHCPv6 to populate the binding table (the v6 analog of the DHCP-snooping database), and every guard consults that table. Beyond RA Guard / DHCPv6 Guard / ND inspection: Source Guard is the v6 IP Source Guard - drop traffic whose source is not in the table; Prefix Guard drops sources outside the prefixes assigned to the link - well-formed but topologically wrong; and Destination Guard refuses to resolve destinations the table does not know - the answer to the v6-specific DoS where scanning a sparse /64 forces the router to hold ND resolution state for thousands of nonexistent hosts. One caveat worth an exam mark: RA Guard sees nothing inside tunnels - tunneled IPv6 bypasses it, so access-edge FHS does not police v6-in-v4 overlays.

Recommendation / justification

Treat these as a standard access-port baseline: DHCP snooping + DAI + IP Source Guard + port security + BPDU/Root Guard, plus the IPv6 first-hop set. They're inexpensive and stop the common rogue-DHCP/ARP-spoof/MAC-flood/rogue-RA attacks. Justify by the principle that the access edge is untrusted.

What would change this (mid-scenario twist)

  • Dual-stack edge -> RA Guard / DHCPv6 Guard / ND inspection are mandatory, not optional.
  • High-security zones -> add VACLs and tighter port security (sticky/violation actions).

Validation checks

  • Is the DHCP-snooping -> DAI -> IP Source Guard chain enabled on access?
  • Are IPv6 first-hop protections (RA Guard etc.) applied, not just v4?

IPv6 / dual-stack note

This is a classic gap: v4 gets DHCP snooping/DAI while rogue RAs roam free on v6. Deploy RA Guard, DHCPv6 Guard, and ND inspection.

Spaced repetition

What chain of features stops ARP spoofing and IP spoofing at the access edge?

DHCP snooping (builds bindings) -> Dynamic ARP Inspection -> IP Source Guard.

The IPv6 first-hop equivalents of DHCP snooping / DAI are [...].

The IPv6 first-hop equivalents of DHCP snooping / DAI are RA Guard, DHCPv6 Guard, and ND inspection.

Port security primarily defends against [...].

Port security primarily defends against MAC flooding / rogue devices (by capping MACs per port).

What attack does IPv6 Destination Guard answer, and how?

ND resolution-state exhaustion - scanning a sparse /64 forces the router to hold resolution state for thousands of nonexistent hosts; Destination Guard drops resolution attempts for destinations not in the binding table.

The IPv6 first-hop security features all consult the [...], populated by IPv6 snooping (ND + DHCPv6 inspection) - the v6 analog of the DHCP-snooping database.

The IPv6 first-hop security features all consult the binding table, populated by IPv6 snooping (ND + DHCPv6 inspection) - the v6 analog of the DHCP-snooping database.

RA Guard's blind spot is [...] - v6-in-v4 overlays bypass access-edge first-hop security.

RA Guard's blind spot is tunneled IPv6 - v6-in-v4 overlays bypass access-edge first-hop security.

Sources

  • Cisco Press, SCOR; Cisco LAN Switching (L2 security).
  • Cisco Press, CCNP ENARSI 300-410 OCG (Edgeworth/Lacoste) - IPv6 first-hop security suite.

domain: Core · blueprint-ref: Core 6.1.e Layer 2 security techniques · type: design-decision · status: complete · tags: [core, core/security, tradeoff/security]

Read more