Network Security (Version1.0) Modules 13 – 14: Layer 2 and Endpoint Security Group Test Online

Hint

Traditional network security has two major focuses: (1) end point protection using antivirus software and enabling the personal firewall, and (2) network border protection with firewalls, proxy servers, and network packet scanning devices or software. This type of protection is not suited for the new network devices that are mobile, frequently access cloud storage, and may be a personal device.

Hint

Internal network protection is just as important as securing the network perimeter. Internal LAN elements can be broken up into endpoints and network infrastructure devices. Common endpoints include laptops, desktops, servers, and IP phones. LAN infrastructure devices include switches and access points.

Hint

Traditional host-based security measures include antivirus/antimalware software, host-based IPS, and host-based firewall. Antivirus and antimalware software detects and mitigates viruses and malware. A host-based IPS is used to monitor and report on the system configuration and application activity, security events, policy enforcement, alerting, and rootkit detection. A host-based firewall restricts incoming and outgoing connections for a particular host.

Hint

In 802.1x, a supplicant is the end-user device (such as a laptop) that is attempting to attach to the WLAN.

Hint

When a port is configured for 802.1X, the port starts in the unauthorized state and stays that way until the client has successfully authenticated.

Hint

When a client supplicant is starting the 802.1X message exchange, an EAPOL-Start message is sent between the supplicant and the authenticator, which is the switch. EAP data between the supplicant and the authenticator is encapsulated in EAPOL frames.

Hint

The aaa authentication dot1x default group radius command specifies that RADIUS is used as the method for 802.1X port-based authentication.

Hint

In an IP address spoofing attack, the IP address of a legitimate network host is hijacked and used by a rogue node. This allows the rogue node to pose as a valid node on the network.

Hint

Spanning Tree Protocol (STP) is a Layer 2 technology for preventing Layer 2 loops between redundant switch paths.

Hint

Loop Guard can be enabled globally using the spanning-tree loopguard default global configuration command. This enables Loop Guard on all point-to-point links.

Hint

To mitigate the chances of ARP spoofing, these procedures are recommended:

• Implement protection against DHCP spoofing by enabling DHCP snooping globally.
• Enable DHCP snooping on selected VLANs.
• Enable DAI on selected VLANs.
• Configure trusted interfaces for DHCP snooping and ARP inspection. Untrusted ports are configured by default.​

Hint

Community ports can send and receive information with ports within the same community, or with a promiscuous port. Isolated ports can only communicate with promiscuous ports. Promiscuous ports can talk to all interfaces. PVLAN edge protected ports only forward traffic through a Layer 3 device to other protected ports.

Hint

Telnet uses plain text to communicate in a network. The username and password can be captured if the data transmission is intercepted. SSH encrypts data communications between two network devices. TFTP and SCP are used for file transfer over the network. SNMP is used in network management solutions.

Hint

One of the procedures to prevent a VLAN hopping attack is to disable DTP (auto trunking) negotiations on nontrunking ports​. DHCP spoofing attacks can be mitigated by using DHCP snooping on trusted ports. The ip verify source interface configuration command is used to enable IP Source Guard on untrusted ports to protect against MAC and IP address spoofing.

Hint

Because the security violation count is at 0, no violation has occurred. The system shows that 3 MAC addresses are allowed on port fa0/2, but only one has been configured and no sticky MAC addresses have been learned. The port is up because of the port status of secure-up. The violation mode is what happens when an unauthorized device is attached to the port. A port must be in access mode in order to activate and use port security.

Hint

The PVLAN Edge feature does not allow one device to see traffic that is generated by another device. Ports configured with the PVLAN Edge feature are also known as protected ports. BPDU guard prevents unauthorized connectivity to a wired Layer 2 switch. SPAN is port mirroring to capture data from one port or VLAN and send that data to another port. DTP (Dynamic Trunking Protocol) is automatically enabled on some switch models to create a trunk if the attached device is configured for trunking. Cisco recommends disabling DTP as a best practice.

Hint

As a result of a CAM table attack, a switch can run out of memory resources to store MAC addresses. When this happens, no new MAC addresses can be added to the CAM table and the switch will forward all received frames to all other ports. This would allow an attacker to capture all traffic that is flooded by the switch.

Hint

802.1x is an IEEE standard that defines port-based access control. By authenticating each client that attempts to connect to the LAN, 802.1x provides protection from unauthorized clients.

Hint

The devices involved in the 802.1X authentication process are as follows:

• The supplicant, which is the client that is requesting network access
• The authenticator, which is the switch that the client is connecting to and that is actually controlling physical network access
• The authentication server, which performs the actual authentication

Hint

802.1X port-based authentication defines specific roles for the devices in the network:

• Client (Supplicant) – The device that requests access to LAN and switch services
• Switch (Authenticator) – Controls physical access to the network based on the authentication status of the client
• Authentication server – Performs the actual authentication of the client

Hint

Cisco ESAs control outbound messages through data-loss prevention (DLP), email encryption, and optional integration with the RSA Enterprise Manager. This control helps ensure that the outbound messages comply with industry standards and are protected in transit.

Hint

The NAC framework uses the Cisco network infrastructure and third-party software to ensure the wired and wireless endpoints that want to gain access to the network adheres to the requirements defined by the security policy. The Cisco NAC Appliance is the device that enforces security policy compliance.

Hint

Cisco provides solutions to help mitigate Layer 2 attacks including:

• IP Source Guard (IPSG) – prevents MAC and IP address spoofing attacks
• Dynamic ARP Inspection (DAI) – prevents ARP spoofing and ARP poisoning attacks
• DHCP Snooping – prevents DHCP starvation and SHCP spoofing attacks
• Port Security – prevents many types of attacks including MAC table overflow attacks and DHCP starvation attacks

Hint

Mitigating a VLAN hopping attack can be done by disabling Dynamic Trunking Protocol (DTP) and by setting the native VLAN of trunk links to VLANs not in use.

Hint

DCHP starvation attacks are launched by an attacker with the intent to create a DoS for DHCP clients. To accomplish this goal, the attacker uses a tool that sends many DHCPDISCOVER messages to lease the entire pool of available IP addresses, thus denying them to legitimate hosts.

Hint

DAI can be configured to check for both destination or source MAC and IP addresses:

• Destination MAC – Checks the destination MAC address in the Ethernet header against the target MAC address in the ARP body.
• Source MAC – Checks the source MAC address in the Ethernet header against the sender MAC address in the ARP body.
• IP address – Checks the ARP body for invalid and unexpected IP addresses including addresses 0.0.0.0, 255.255.255.255, and all IP multicast addresses.