notes: VACL

VACL

- VLAN access map similar to route-map
- Is used to apply a layer3 filter to layer2 transit traffic.
- Uses route-map logic to permit(forward) or deny(drop) traffic.
- Changes made to the access-map, will not take effect until the access-map is removed and re-applied.
- ONLY a ACL-permit performs the "forward"/"drop" function in the access-map. A ACL-deny will be ignored.
- So to deny traffic with VLAN ACL's, permit the traffic and use a "drop" action in the access-map.

MAC-ACL’s will only match NON-IP traffic.
- Cisco 3560 switch sees IPv6 traffic as IP-traffic, but a Cisco 3550 switch sees IPv6 traffic as NON-IP-traffic.
- Ethertypes are not fully listed on IOS command help or DOC-CD,

memorise!
0x0806 0x0 : ARP
0x0800 0x0 : IPv4
0x86DD 0x0 : IPv6
0xAAAA 0x0 : CISCO proprietary (STP, PAGP, VTP, PVST+, CDP, DTP, and UDLD)
0x4242 0x0 : CST

config-set: Blocks all ICMP echo’s & IPv6 on VLAN-162 but forward all other
access-list 101 permit icmp any any echo

mac access-list extended EtherType
permit any any 0xAAAA 0x0
!
vlan access-map VACL 10
action drop
match ip address 101 - Drops ICMP Echo
vlan access-map VACL 20
action drop
match mac address EtherType
vlan access-map VACL 30
action forward - Forwards all other traffic
!
vlan filter VACL vlan-list 162 - Applies access-map

notes: DHCP Snooping and IP Source Guard

DHCP Snooping

- DHCP snooping is a feature that provides network security by filtering untrusted DHCP messages and by building and maintaining a DHCP snooping binding database.
- acts like a firewall between untrusted hosts and DHCP servers.
- One can use DHCP snooping to differentiate between untrusted interfaces connected to the end user and trusted interfaces connected to the DHCP server or another switch.

enable snooping globally:

ip dhcp snooping

ip dhcp snooping vlan #

interface command:

interface FastEthernet 0/1
ip dhcp snooping trust
ip dhcp snooping limit rate 200


IP Source Guard

- IP Source Guard is a Catalyst security feature related to DHCP snooping.
- IP source guard helps prevent IP spoofing by enabling only the IP addresses obtained through DHCP snooping on a particular port. When a client receives an IP address from the authorized DHCP server, a port access control list (PACL) is installed on the port. This PACL enables traffic in the interface if it is sourced from the DHCP provided IP address.

global command:

ip verify source vlan dhcp-snooping port-security

notes: Switchport Security

port security feature to restrict input to an interface by limiting and identifying MAC addresses of the stations allowed to access the port.
- Can only be configured on static access or trunk ports. No dynamic links.

You can configure these types of secure MAC addresses:

1. Static secure MAC addresses: Manually configured by using the switchport port-security mac-address
- MAC address interface configuration command.

2. Dynamic secure MAC addresses: Dynamically learned, stored only in the address table and removed when the switch restarts.

3. Sticky secure MAC addresses: Dynamically learned or manually configured, stored in the address table and added to the running configuration. These addresses can be saved in the configuration file.


3 violation modes, based on the action to be taken if a violation occurs:

1. Protect: Packets with unknown source addresses are dropped until you remove a sufficient number of secure MAC addresses or increase the number of maximum allowable addresses.

2. Restrict: Packets with unknown source addresses are dropped until you remove a sufficient number of secure MAC addresses or increase the number of maximum allowable addresses; you are notified.
-Generates SNMP/Syslogs.

3. Shutdown: Port security violation causes the interface to immediately become error-disabled and turns off the port LED; it also sends a Simple Network Management Protocol (SNMP) trap, logs a syslog message, and increments the violation counter.


command set to configure port security:

switchport port-security
switchport port-security maximum value [vlan [vlan-list]]
switchport port-security violation {protect | restrict | shutdown}
switchport port-security mac-address mac-address [vlan vlan-id]
switchport port-security mac-address sticky

You can use port security aging to set the aging time for static and dynamic secure addresses on a port. Two types of aging are supported per port:

1. Absolute: The secure addresses on the port are deleted after the specified aging time.
2. Inactivity: The secure addresses on the port are deleted only if the secure addresses are inactive for the specified aging time.

command:

switchport port-security aging {static | time time | type {absolute | inactivity}}

setting error disable aging for port security:

errdisable recovery cause psecure-violation
errdisable recovery interval 5400 (sec)

notes: Private VLANS, protected ports

Private VLANs

- Can split a single broadcast domain, defined by a single VLAN, into multiple isolated broadcast subdomains, that are defined by primary VLAN and secondary VLANs.
- Basically it is VLANs inside a VLAN.
- Commonly used in shared layer2 environments, like ISP co-locations/hotel rooms, so two sites/rooms can't communicate directly.
- PVLANs can only be configured when a switch is in VTP transparent mode!!!
- Difference between PVLAN and protected port, PVLAN can span multiple switches whereas protected ports don't.
- Private VLAN information is NOT propagated via VTP.
- Secondary VLANs (isolated and community) do not run their own instance of spanning-tree.

Different port roles:

1. Promiscuous ports - Are allowed to talk to all other ports within the VLAN.
- Are the roles assigned to the primary VLAN ports.

2. Community ports - Are allowed to talk to any other ports only in the same community.

3. Isolated ports - Can only talk to other promiscuous ports.


steps to configure Private VLANS

Note: must be in vtp transparent mode ( so vtp domain must be configured)

1. Create the secondary VLANs as community or isolated.

vlan 1000
private-vlan community

vlan 2000
private-vlan isolated

2. Create the primary VLANs and associate the secondary VLANs.

vlan 100
private-vlan primary
private-vlan association 1000,2000

3. Assign ports to which mode and map/associate it with secondary vlans

interface fa0/1
switchport mode private-vlan promiscuous
switchport private-vlan mapping 100 1000,2000

int fa0/2
switchport mode private-vlan host
switchport private-vlan host-association 100 1000

int fa0/3
switchport mode private-vlan host
switchport private-vlan host-association 100 2000

verification:

show vlan private-vlan


Protected Ports:

are used to prevent traffic from being exchanged at layer 2 between two or more ports that are in the same VLAN.
- Traffic received in a protected port cannot be sent out another protected port, however traffic received in a protected port can be sent out a non-protected port.
This feature is a much smaller subset of the Private VLAN feature, and cannot span between multiple physical switches.


command:

interface FastEthernet0/2
switchport protected

interface FastEthernet0/24
switchport protected

notes: 802.1X Port-Based Authentication

defines a client/server-based access control and authentication protocol that restricts unauthorized clients from connecting to a LAN through publicly accessible ports.

remembers
- DO NOT forget to add “aaa authentication login default none”, else you might lock the switch and forfeit any points related to that switch.
- Uses AAA with RADIUS for authentication
- everytime " aaa new-model" is type it will erase existing aaa config.

You control the port authorization state by using the dot1x port-control interface configuration command and these keywords:

1. force-authorized: Disables 802.1X authentication and causes the port to transition to the authorized state without any authentication exchange required

2. force-unauthorized: Causes the port to remain in the unauthorized state, ignoring all attempts by the client to authenticate

3. auto: Enables 802.1X authentication and causes the port to begin in the unauthorized state

802.1X port-based authentication is supported in two topologies:

1. Point-to-point
2. Wireless LAN

Use the following commands to enable 802.1X authentication. Note that dot1x authentication requires RADIUS as the method.

global:

aaa new-model
aaa authentication dot1x default group radius
dot1x system-auth-control

radius-server host 10.10.10.10
radius-server key cisco
aaa authorization network default group radius

interface:
dot1x port-control auto
dot1x host-mode multihost (multiple devices can be authenticated on that single port)
dot1x auth-fail vlan 888
dot1x auth-fail max 2 (default:3)
dot1x guest-vlan 888
dot1x critical vlan 24 (if port authentication failed, and to ensure port comes up)