TYBSc-IT IS

Practical No. 7
Aim: Packet Tracer - Layer 2 Security

Addressing Table

Device Interface IP Address Subnet Mask Default

Gateway

R1 G0/1 [Link] [Link] N/A

S0/0/0 [Link] [Link] N/A

C1 NIC [Link] [Link] [Link]

C2 NIC [Link] [Link] [Link]

C3 NIC [Link] [Link] [Link]

C4 NIC [Link] [Link] [Link]

D1 NIC [Link] [Link] [Link]

TYBSc-IT IS

D2 NIC [Link] [Link] [Link]

D3 NIC [Link] [Link] [Link]

D4 NIC [Link] [Link] [Link]

Objectives
• Assign the Central switch as the root bridge.
• Secure spanning-tree parameters to prevent STP manipulation attacks.
• Enable port security to prevent CAM table overflow attacks.

Background
There have been a number of attacks on the network recently. For this reason, the
network administrator has assigned you the task of configuring Layer 2 security.
For optimum performance and security, the administrator would like to ensure that the
root bridge is the 3560 Central switch. To prevent spanning-tree manipulation attacks,
the administrator wants to ensure that the STP parameters are secure. To prevent
against CAM table overflow attacks, the network administrator has decided to configure
port security to limit the number of MAC addresses each switch port can learn. If the
number of MAC addresses exceeds the set limit, the administrator would like the port to
be shutdown.

Part 1: All switch devices have been configured with the following
commands:

Router R1:
R1(config)#enable secret enpass123
R1(config)#line console 0
R1(config-line)#password conpass123
R1(config-line)#login
R1(config-line)#ip domain-name [Link]
R1(config)#username admin secret adminpass123
TYBSc-IT IS

R1(config)#line vty 0 4
R1(config-line)#login local
R1(config-line)#crypto key generate rsa

Note: Use same command for switch SW-1, SW-2, SW-A, SW-B

Part 2: Configure Root Bridge

Step 1: Determine the current root bridge.
From Central, issue the show spanning-tree command to determine the current root
bridge, to see the ports in use, and to see their status.
Which switch is the current root bridge?

Step 2: Assign Central as the primary root bridge. Using the spanning-tree vlan 1
root primary command, and assign Central as the root bridge.
Central(config)# spanning-tree vlan 1 root primary
TYBSc-IT IS

Step 3: Assign SW-1 as a secondary root bridge. Assign SW-1 as the secondary root
bridge using the spanning-tree vlan 1 root secondary command.

SW-1(config)# spanning-tree vlan 1 root secondary

Step 4: Verify the spanning-tree configuration. Issue the show spanning tree
command to verify that Central is the root bridge.
Central# show spanning-tree

Part 3: Protect Against STP Attacks

Step 1: Enable PortFast on all access ports & Enable BPDU guard on all access
ports.

SW-A(config)# interface range f0/1 - 4

SW-A(config-if-range)# spanning-tree portfast
SW-A(config-if-range)# spanning-tree bpduguard enable
TYBSc-IT IS

Note : Use same command as above for SW-B

Step 2: Enable root guard.

Root guard can be enabled on all ports on a switch that are not root ports. It is best
deployed on ports that connect to other non-root switches. Use the show spanning-tree
command to determine the location of the root port on each switch.
On SW-1, enable root guard on ports F0/23 and F0/24. On SW-2, enable root guard on
ports F0/23 and F0/24

SW-1(config)# interface range f0/23 - 24

SW-1(config-if-range)# spanning-tree guard root

Note: Use same above command for SW-2

TYBSc-IT IS

Part 4: Configure Port Security and Disable Unused Ports

Step 1: Configure basic port security on all ports connected to host devices.
This procedure should be performed on all access ports on SW-A and SW-B. Set the
maximum number of learned MAC addresses to 2, allow the MAC address to be learned
dynamically, and set the violation to shutdown. Note: A switch port must be configured
as an access port to enable port security.

SW-A(config)# interface range f0/1 - 22

SW-A(config-if-range)# switchport mode access
SW-A(config-if-range)# switchport port-security
SW-A(config-if-range)# switchport port-security maximum 2
SW-A(config-if-range)# switchport port-security violation shutdown
SW A(config-if-range)# switchport port-security mac-address sticky

Note: Use same above command for SW-B

Step 2: Verify port security.

a. On SW-A, issue the command show port-security interface f0/1 to verify that port
security has been configured.
SW-A# show port-security interface f0/1
TYBSc-IT IS

b. Ping from C1 to C2 and issue the command show port-security interface f0/1
again to verify that the switch has learned the MAC address for C1.

After pinging C2 from C1 :

TYBSc-IT IS

Step 3: Disable unused ports.

Disable all ports that are currently unused.

SW-A(config)# interface range f0/5 - 22

SW-A(config-if-range)# shutdown

Note : Use same above command for switch SW-B