Network Security · Topic 2 of 8

Segmentation, Port Security and Layer 2 Hardening

Configure VLAN and SGT segmentation, port security, and defences against MAC flooding, VLAN hopping and spanning tree attacks on Cisco IOS XE switches.

5 min
Includes a diagram

In a nutshell

An SGT is a group label from ISE, enforced with SGACLs, and independent of IP address.
Port security limits MAC addresses per port and defends against MAC flooding.
Violation modes are protect, restrict and shutdown, and shutdown is the default.

What it is

Layer 2 security limits what an attached device can do, and segmentation limits how far an attacker can move.

Switches trust their ports by default. A device that plugs in can flood the MAC table, claim to be a trunk or take over spanning tree. Segmentation divides the network into smaller zones, and Layer 2 protections close the common switch level attacks.

How it works

Use segmentation for design, and port level features for enforcement.

Segmentation with VLANs

A VLAN is a separate Layer 2 broadcast domain. Traffic between VLANs must pass a Layer 3 device, where an ACL or firewall can filter it. Put user, server, voice, guest and management traffic in different VLANs.

Segmentation with SGTs

A user logs in through a switch, Cisco ISE returns a Security Group Tag by RADIUS, the tag travels with the frame inline or by SXP, and an enforcement point applies an SGACL between source and destination groups before the server. VLANs follow topology, so policy depends on addresses and subnets. Cisco TrustSec uses a Security Group Tag (SGT) instead, which is a label that follows the user or device. Cisco ISE assigns the tag at login, and network devices or firewalls enforce rules between tags.

The rules form a matrix of source group and destination group, using SGACLs. This means policy stays the same when a user moves ports or subnets. The tag is carried inline in the Ethernet frame on capable links, or distributed between devices with the SGT Exchange Protocol (SXP).

Method	Policy is based on
VLAN with ACL	Subnet and IP address
SGT with SGACL	Group label assigned by identity

Port security

Port security limits which MAC addresses may use an access port, and it defends against MAC flooding. In a flood, an attacker sends frames with many fake source MACs until the table is full, and then the switch floods traffic out of all ports.

Switch(config)# interface GigabitEthernet0/5
Switch(config-if)# switchport mode access
Switch(config-if)# switchport access vlan 10
Switch(config-if)# switchport port-security
Switch(config-if)# switchport port-security maximum 2
Switch(config-if)# switchport port-security mac-address sticky
Switch(config-if)# switchport port-security violation restrict

Sticky learning saves the MAC addresses that the port learns into the running configuration. There are three violation modes.

Mode	Drops violating frames	Logs and counts	Port err disabled
protect	Yes	No	No
restrict	Yes	Yes	No
shutdown (default)	Yes	Yes	Yes

Switch# show port-security interface GigabitEthernet0/5
Switch# show errdisable recovery

An err disabled port stays down until an administrator runs shutdown then no shutdown, or until automatic recovery is configured.

VLAN hopping

A double tagging attack: the attacker sends a frame with two 802.1Q tags, the first switch removes the outer tag that matches the native VLAN, and the inner tag delivers the frame into another VLAN. In switch spoofing, the attacker negotiates a trunk using DTP and then reaches every VLAN. In double tagging, the attacker sends a frame with two 802.1Q tags, and the first switch removes the outer tag, which equals its native VLAN. The inner tag then carries the frame into another VLAN.

Switch(config)# interface GigabitEthernet0/5
Switch(config-if)# switchport mode access
Switch(config-if)# switchport nonegotiate
Switch(config)# interface GigabitEthernet0/48
Switch(config-if)# switchport trunk native vlan 999

Set user ports to access mode, disable DTP, use an unused native VLAN on trunks, and shut down unused ports.

Spanning tree attacks

An attacker who sends superior BPDUs can become the root bridge and pull traffic through their device. Two features defend against this.

BPDU guard: err disables a PortFast port that receives a BPDU.
Root guard: stops a port from accepting a superior BPDU, and blocks it in a root inconsistent state.

Switch(config)# spanning-tree portfast default
Switch(config)# spanning-tree portfast bpduguard default
Switch(config)# interface GigabitEthernet0/24
Switch(config-if)# spanning-tree guard root

Use BPDU guard on edge ports and root guard on ports that face switches that should never become root.

What to remember for the exam

Seven facts cover most questions on this topic.

An SGT is a group label from ISE, enforced with SGACLs, and independent of IP address.
Port security limits MAC addresses per port and defends against MAC flooding.
Violation modes are protect, restrict and shutdown, and shutdown is the default.
Double tagging uses the native VLAN, and switch spoofing uses DTP.
Use switchport mode access and switchport nonegotiate on user ports.
BPDU guard protects edge ports, and root guard protects the root bridge placement.
A shutdown violation puts the port in err disabled state.

Exam tip

To tell BPDU guard from root guard, remember that BPDU guard is for edge ports and root guard is for ports facing other switches.

Common mistakes

These four mistakes appear often.

Leaving user ports in dynamic mode. The port may negotiate a trunk, which allows switch spoofing.

Using VLAN 1 as the native VLAN. Use an unused VLAN, so double tagging has no easy path.

Setting the maximum to one on an IP phone port. A phone with a PC behind it uses more than one MAC address.

Forgetting recovery. An err disabled port does not return by itself unless recovery is configured.

Watch out

Port security alone does not stop an attacker from spoofing one allowed MAC address, so combine it with other controls.

Check yourself

Work through these three questions.

What does the default violation mode do?
The default is shutdown, which drops the frames, logs and counts the violation, and puts the port in err disabled state.
How does double tagging reach another VLAN?
The first switch strips the outer tag that matches the native VLAN, and the inner tag then carries the frame into another VLAN.
Which feature err disables a PortFast port that receives a BPDU?
BPDU guard does this, as it protects edge ports from rogue switches.

Topic 2 of 8 in Network Security

Test yourself on Network Security

The full Cisco CCNP 350-701 SCOR question bank has 822 questions, with timed practice exams and an explanation for every answer.

Subscribe Try Sample Exam

This study guide is independent and is not affiliated with, endorsed by, or sponsored by Cisco. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.