2 Layer 2 Security

Layer 2 security goals

Layer 2 security protects the local Ethernet network from unauthorized devices, rogue DHCP servers, address spoofing, and spanning-tree manipulation. The controls work best together: VLAN and port configuration limit exposure, inspection features validate traffic, and spanning-tree safeguards protect the topology.

Restricting access ports

Port security limits which source MAC addresses a switch port accepts. Set a maximum number of addresses, then configure addresses manually or use sticky learning, which learns addresses and adds them to the configuration. For example, a desk port might allow one computer, or a phone and a computer.

A violation can drop unauthorized traffic, log the event, or disable the port. Plan for legitimate devices and recovery before choosing an action, because disabling a port can interrupt service.

Limiting VLAN and trunk exposure

Reduce VLAN and trunk exposure through deliberate port configuration:

• Configure endpoint interfaces as access ports in the intended user VLAN; do not leave them negotiating trunks.

• On trunks, explicitly permit only required VLANs and select a native VLAN that carries no user traffic.

• Put unused interfaces in an unused VLAN and administratively shut them down.

• Keep management traffic separate from ordinary user traffic where practical.

These practices reduce accidental or unauthorized access between VLANs and limit the impact of a compromised port.

Validating DHCP and ARP traffic

DHCP snooping filters DHCP messages at the switch. Client-facing ports are untrusted by default; mark only the interface leading to an authorized DHCP server or trusted network path as trusted. DHCP snooping builds a binding table associating leased IP addresses with MAC addresses, VLANs, and interfaces. This helps block rogue DHCP offers and provides data for other protections.

Dynamic ARP Inspection (DAI) checks ARP messages arriving on untrusted ports against valid IP-to-MAC bindings, usually learned through DHCP snooping. Invalid ARP packets are dropped, helping prevent ARP spoofing and poisoning. For statically addressed devices, configure appropriate ARP ACLs or bindings if supported. Trust only infrastructure interfaces that should bypass inspection, because ARP packets on a trusted interface are not checked.

Configuring DHCP snooping and DAI

The following simplified Cisco IOS XE-style example trusts the uplink for DHCP snooping and DAI because it leads to the authorized network; client ports remain untrusted. Adapt VLANs and interface names to the actual design.

Before relying on DAI, confirm that the DHCP binding table is populated and that legitimate clients can obtain addresses. A missing or incomplete binding, or an untrusted path between switches, can cause valid ARP traffic to be dropped. Use ARP ACLs for static-address environments and test the result carefully.

Protecting the spanning-tree topology

Spanning Tree Protocol (STP) prevents Layer 2 loops, but rogue devices or misconfigurations can disrupt its topology. Choose safeguards according to the expected role of each port:

• PortFast, or the platform’s edge-port setting, lets an end-device port enter forwarding promptly. Use it only where an endpoint—not another switch—is expected.

• BPDU Guard disables or blocks an edge port if it receives an STP BPDU. Enable it on edge ports to catch an unexpected switch; investigate and deliberately restore a port after a violation.

• Root Guard prevents a designated port from accepting superior BPDUs that could move the root role to an unintended switch. Use it on links where a downstream switch must not become root.

• Loop Guard helps prevent a non-designated port from mistakenly forwarding when expected BPDUs stop arriving, such as after a unidirectional link failure. Apply it to appropriate redundant infrastructure links, not as a substitute for BPDU Guard on endpoint ports.

Do not apply every STP guard indiscriminately. For example, BPDU Guard is suitable for a workstation port, while Root Guard may be appropriate on a link to a downstream switch. Misapplied protections can block legitimate connectivity.

Verifying and operating the controls

After configuration, verify port-security status and violations, DHCP snooping trust and bindings, DAI VLAN status and drops, and STP port roles and guard events. Test both authorized and unauthorized cases.

Document trusted interfaces, the unused-port policy, and the process for investigating disabled or blocked ports. Cisco command syntax varies by switch platform and software version, so verify commands against the device’s configuration guide.