5.5 Layer 2 Security Features

Why Layer 2 Matters

Layer 2 attacks are dangerous because they sit below the Layer 3 controls (ACLs, firewalls) most people think of as "security." A switch with no Layer 2 hardening can be subverted from a single access port. The CCNA pairs each attack with its specific countermeasure, so learn them as matched sets.

DHCP Snooping

DHCP snooping divides switch ports into trusted and untrusted.

If an untrusted port receives a server message (OFFER/ACK), the switch drops it — a rogue DHCP server cannot hand clients a poisoned default gateway. Snooping also builds a binding table mapping MAC → IP → VLAN → port, which DAI then reuses.

Switch(config)# ip dhcp snooping
Switch(config)# ip dhcp snooping vlan 10,20,30
Switch(config)# interface Gig0/24            ! Uplink to DHCP server
Switch(config-if)# ip dhcp snooping trust
Switch# show ip dhcp snooping binding

Dynamic ARP Inspection (DAI)

DAI stops ARP spoofing by checking each ARP packet on an untrusted port against the DHCP snooping binding table. If the source MAC/IP pair matches a binding, the ARP is forwarded; if not, it is dropped. DAI requires DHCP snooping — without the binding table it has nothing to validate against. This dependency is a frequent exam trap.

Switch(config)# ip arp inspection vlan 10,20,30
Switch(config)# interface Gig0/24
Switch(config-if)# ip arp inspection trust
Switch# show ip arp inspection statistics

Port Security

Port security limits how many MAC addresses a port may learn, defeating MAC flooding that would otherwise turn the switch into a hub.

Switch(config)# interface Gig0/1
Switch(config-if)# switchport mode access            ! Required — must be access
Switch(config-if)# switchport port-security
Switch(config-if)# switchport port-security maximum 2
Switch(config-if)# switchport port-security mac-address sticky
Switch(config-if)# switchport port-security violation shutdown

sticky learns MACs dynamically and writes them into the running config. A port stuck on a trunk or DTP-negotiated port will not accept port security — it must be a static access port.

Violation Modes

Recovering an Err-Disabled Port

Switch(config)# interface Gig0/1
Switch(config-if)# shutdown
Switch(config-if)# no shutdown
! Or automate it:
Switch(config)# errdisable recovery cause psecure-violation
Switch(config)# errdisable recovery interval 300

802.1X Port-Based Access Control

802.1X authenticates a device before the port forwards user traffic, using three roles:

• Supplicant — the client software on the end device
• Authenticator — the switch, which relays credentials
• Authentication server — a RADIUS server (e.g., Cisco ISE) that decides yes/no

The client and server exchange EAP (Extensible Authentication Protocol) messages; the switch carries them as EAPOL. Until authentication succeeds, only EAPOL traffic is allowed on the port.

Wireless Security Protocols

• WPA2/WPA3-Personal (PSK / SAE): one passphrase, suited to homes and small offices.
• WPA2/WPA3-Enterprise (802.1X): unique per-user credentials via RADIUS, used in enterprises. WPA3 replaces the PSK 4-way-handshake weakness with SAE (Simultaneous Authentication of Equals).

Secure MAC Address Types

Port security tracks three kinds of secure MAC entries, and the difference matters for whether your config survives a reboot:

The sticky option is popular because it learns the legitimate device once and then pins it, but remember you must save the config or the sticky entries are lost on reboot.

Verifying Port Security

Switch# show port-security
Switch# show port-security interface Gig0/1
Switch# show port-security address

The per-interface output shows the violation mode, the maximum and current MAC count, the last violating MAC, and the violation counter — your first stop when a port lands in err-disabled.

BPDU Guard and DTP Hardening

Two more access-port protections appear repeatedly. BPDU Guard err-disables any access port that receives a spanning-tree BPDU, which stops someone from plugging an unauthorized switch into a user port and hijacking the spanning-tree topology. It pairs naturally with PortFast on access ports. Separately, leaving Dynamic Trunking Protocol (DTP) enabled lets an attacker negotiate a trunk from a user port and reach every VLAN; switchport mode access plus switchport nonegotiate shuts that door. These, with DHCP snooping, DAI, and port security, form the standard access-layer security baseline.

On the Exam: Memorize the attack-to-mitigation pairs above. Remember DAI depends on DHCP snooping, the default violation mode is shutdown, port security needs an access port, and WPA2-AES is the minimum acceptable Wi-Fi security.