Securing switches and routers: VLANs, port security, DHCP snooping and ACLs

Switches and VLANs

A switch connects computers, printers and servers so they can share resources and talk to each other anywhere in a building or campus. VLANs split one physical switched network into several logical networks, each its own broadcast domain; traffic between VLANs must pass through a router. VLANs:

• reduce broadcast traffic and the size of broadcast domains;
• add a layer of security by separating groups;
• group devices by function instead of location;
• make management easier.

A trunk carries many VLANs between switches, adding an IEEE 802.1Q tag to each frame. Disable automatic trunk negotiation on user ports to stop VLAN-hopping attacks.

Port security

A switch learns MAC addresses as frames arrive. Port security limits how many MAC addresses a port may learn, can fix ("sticky") the allowed addresses, and applies a penalty when an unknown device connects:

• Shutdown (default): the port is disabled (err-disabled) and an alert is logged.
• Restrict: unknown traffic is dropped and logged.
• Protect: unknown traffic is dropped silently.

DHCP snooping

DHCP snooping marks the uplink to the real DHCP server as trusted and every user port as untrusted. The switch then drops:

• DHCP server messages arriving on untrusted ports (rogue servers);
• client messages that don't match its binding table or exceed rate limits;
• relay messages carrying option 82 information on untrusted ports.

Its binding table also powers Dynamic ARP Inspection, which stops ARP spoofing.

Routers and access control lists

A router connects networks, such as several switched LANs, branch sites and the internet. An Access Control List (ACL) is an ordered list of permit and deny rules applied to traffic entering or leaving an interface. Rules are checked top to bottom, and an invisible deny all sits at the end.

• Standard ACL (numbers 1–99): checks only the source IP address. Less CPU work, less precise.
• Extended ACL (numbers 100–199 or named): checks source and destination addresses, protocol and ports. More precise, more CPU work.

NAT on the network edge

NAT changes IP addresses (and ports) as packets cross a router or firewall. It reduces how many public addresses a company needs and hides internal address ranges.

1. Static NAT: one private address always maps to the same public address (for servers).
2. Dynamic NAT: private addresses borrow addresses from a pool of public ones.
3. PAT (NAT overload): many devices share one public address, each with a different port number.

NAT hides addresses but is not a firewall: always filter traffic too. Device commands for all of these are in the switch and router command pages.

Real-world example: segmenting a primary school

A primary school ran staff PCs, pupil tablets, the office printer and the CCTV recorder on one flat network. A pupil's tablet could reach the CCTV recorder's web login page. The school's IT support company split the network into four VLANs: staff, pupils, printers and CCTV. Access ports were set to a single VLAN with port security limited to two MAC addresses, unused ports were shut down, and DHCP snooping was enabled so that only the server uplink could hand out addresses.

On the router, an access control list allowed the pupil VLAN to reach only the internet and the printers, and blocked it from the staff and CCTV VLANs. NAT continued to share the school's single public address. The change took one evening, and the CCTV system was no longer visible to anyone outside the office.