Chapter 8 of 11 · MikroTik MTCSWE
Layer 2 Security
IGMP and DHCP snooping, loop protect, storm control, filters, ACL, BPDU guard, port security, 802.1X.
- 7topics
- 32 minfast track
- 2diagrams and exhibits
Topics in this chapter
Take them in order, or jump to the one you need.
- 1IGMP SnoopingLearn how IGMP snooping limits multicast to interested ports, how the querier and multicast router ports work, and how to enable…4 min
- 2DHCP Snooping and ARP ModesBlock rogue DHCP servers with DHCP snooping and trusted ports, add Option 82, and use RouterOS ARP modes such as reply only to…Diagram5 min
- 3Loop Protect and Traffic Storm ControlStop accidental cable loops with RouterOS loop protect, and limit broadcast, multicast and unknown unicast floods with port flood…4 min
- 4Layer 2 Firewall and Bridge Filter FeaturesUse the RouterOS bridge filter as a Layer 2 firewall with input, forward and output chains, MAC and protocol matchers, actions…4 min
- 5Switch ACL and Switch SecurityWrite switch chip rules that drop, redirect or copy traffic at wire speed, and apply a practical hardening checklist for ports…5 min
- 6BPDU Guard and Port SecurityProtect access ports with BPDU guard and edge ports, and control which MAC addresses may use a port with learning limits, static…5 min
- 7802.1X Port Based AuthenticationUnderstand 802.1X roles and EAPOL, how a RADIUS server authorises a port, and how RouterOS acts as an authenticator and as a…Diagram5 min
About this chapter
What this chapter covers
Layer 2 Security shows how to protect a switched network from mistakes, misuse and attacks at the access edge.
It has twelve syllabus topics, grouped into seven pages. They cover traffic control, address protection, filtering and authentication, and each topic closes a different kind of hole.
Most of the features work on the bridge, and some work in the switch chip.
The features also depend on each other. Spanning tree protection needs edge ports, flood control needs to know about multicast, and a strict ARP mode needs DHCP to create entries. Read the pages with these links in mind, and watch for the places where one page refers to another.
How the topics fit together
The topics form layers, from the port outward.
Think of the topics in these groups:
- Who is connected: port security, 802.1X, BPDU guard.
- What they may send: the Layer 2 firewall, bridge filter, switch ACL.
- How addresses are protected: DHCP snooping and ARP modes.
- How floods are controlled: IGMP snooping, loop protect, storm control.
- General habits: the switch security checklist.
The chip and the CPU can both filter. Chip rules keep full speed, and CPU rules give more matchers and cost speed.
How to use these pages
Each topic page has the same shape, so you can skim for what you need.
- What it is: the idea in plain words.
- How it works: the mechanism, with diagrams and example commands.
- What to remember for the exam: the facts to memorise.
- Common mistakes: the classic traps.
- Check yourself: three questions to test your understanding.
Many of these features can lock you out of a device, so practise on a lab switch with a second access path. After each feature, test two things: that the attack is blocked, and that normal traffic still works.
Ready for more practice?
The full MikroTik MTCSWE question bank has 484 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by MikroTik. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.