CCNP Security Secure 642-637 Quick Reference: Cisco Layer 2 Security
Date: Mar 15, 2011
A lot of attention is paid to securing the higher layers of the OSI reference model with network-level devices such as firewalls, intrusion protection systems (IPS), and applications such as antivirus and host-based intrusion protection (HIPS).
Layer 2 attacks occur, as you would expect, at Layer 2 of the OSI model. We know that switching operates at Layer 2; therefore, most of these attacks need to be mitigated in the switches you deploy in your network.
Layer 2 attacks are often overlooked when designing a network security solution; it is quite normal to find Layer 2 networks with no protection whatsoever. The availability of dedicated Layer 2 attack tools makes it necessary to defend against possible attack by implementing the features that Cisco offers within IOS Software.
One of the best tools used for testing Layer 2 security is Yersinia that is freely available from http://www.yersinia.net/ and is part of the BackTrack 4 security distribution.
Types of Layer 2 Attacks
This section covers several types of Layer 2 attacks. This section also explains how to mitigate these attacks by implementing the correct control in Cisco IOS.
Following are the main types of Layer 2 attacks:
- CAM overflow
- VLAN hopping
- MAC spoofing
- Private VLAN attacks
- DHCP attacks
CAM Overflow
Switches operate by building a reference table of MAC addresses and corresponding switch ports. Based on the destination MAC address, the switch knows which port to forward the frames to. This table is called the context-addressable memory (CAM) table.
The switch can hold only a specific number of MAC addresses in this table, depending on the resources available to the switch.
A CAM overflow attack occurs when an attacker connects to a single or multiple switch ports and then runs a tool that mimics the existence of thousands of random MAC addresses on those switch ports. The switch enters these into the CAM table, and eventually the CAM table fills to capacity. When a switch is in this state, no more new MAC addresses can be learned; therefore, the switch starts to flood any traffic from new hosts out of all ports on the switch.
A CAM overflow attack turns a switch into a hub, which enables the attacker to eavesdrop on a conversation and perform man-in-the-middle attacks.
A common tool that performs CAM overflows is macof and is part of the Dsniff set of tools. This tool generates hundreds of thousands of random MAC addresses and floods these out onto the network. This is a useful tool for testing to see if your switch infrastructure is susceptible to CAM overflow attacks.
Cisco implemented a technology into IOS called Port Security that mitigates the risk of a Layer 2 CAM overflow attack.
Port Security
Port Security on a Cisco switch enables you to control how the switch port handles the learning and storing of MAC addresses on a per-interface basis. The main use of this command is to set a limit to the maximum number of concurrent MAC addresses that can be learned and allocated to the individual switch port.
If a machine starts broadcasting multiple MAC addresses in what appears to be a CAM overflow attack, the default action of Port Security is to shut down the switch interface; although, you can configure the switch just to discard any future Layer 2 frames received from the bogus MAC addresses.
Configuring Port Security
You must configure Port Security at the interface configuration level on a Cisco IOS switch. You need to allow Port Security on static access ports rather than dynamic access or trunk ports.
For illustrative purposes, this section shows a common Port Security configuration. You can configure Port Security to dynamically enable three MAC addresses on the configured port and make these connections sticky.
Start by ensuring that the switch port is a static access port:
Switch(config-if)# switchport mode access
The next step is to allow Port Security on the switch interface and to configure a maximum of three MAC addresses for the interface:
Switch(config-if)# switchport port-security Switch(config-if)# switchport port-security maximum 3
The switch learns the MAC addresses connected on the switch port and enables the first three it finds. In most cases, it is only a single end-user workstation connected to the switch and should see only a single MAC address. The switch needs to go through this process whenever you reboot the switch. You can allow the sticky mode for Port Security so that the MAC addresses that the switch learns about are stored when the configuration is saved so that they do not need to be relearned when the switch reboots. To allow sticky learning, enter the following command:
Switch(config-if)# switchport port-security mac-address sticky
You just reviewed a common configuration scenario in which the switch dynamically learns and remembers the MAC address of the devices connected to it. The other, and more secure, mechanism is to configure static Port Security by manually specifying the MAC address of the host connected to it.
If you have a switch port with the host MAC address 00:16:cb:96:95:94 connected to it, you can enter the following command to ensure that only this host can connect to the switch port:
Switch(config-if)# switchport port-security mac-address 0016.cb96.9594
The default mode of port-security operation is to shutdown the port. There are three configurable modes of operation for port security - Shutdown, Restrict and Protect.
In the event that the switch port receives more MAC addresses than the configured maximum the port-security mode of operation dictates the action taken by the switch.
Shutdown. In the event that the switch port receives more MAC addresses than the configured maximum, the switch will shutdown the switch port. This is the default action mode.
Restrict. Restrict drops packets from unknown source MAC addresses received on the switch port and sends an SNMP Trap or a Syslog message to an administrator. The violation counter is also incremented.
Protect. Protect drops packets from unknown source MAC addresses. No SNMP Trap or Syslog message is generated and the violation counter is not incremented.
The following command is used to change the port-security mode of operation:
switchport port-security violation {shutdown | restrict | protect}
VLAN Hopping
Switches implement virtual LANs (VLAN). Users connect to access ports that are members of a VLAN as specified in the switch configuration. VLAN hopping is where a user can gain access to a VLAN not assigned to the switch port to which the user connects.
A user can achieve this in two ways against the default configuration of a Cisco switch port. The first and most commonly used VLAN hopping method is where the attacker makes his workstation act as a trunk port. Most switches, in the default configuration, need only one side of a connection to announce themselves as a trunk; then the switch automatically trunks all available VLANs over the switch port. This results in the attacker seeing all traffic across all VLANs.
The second way an attacker can hop VLANs is by using double tagging. With double tagging, the attacker inserts a second 802.1q tag in front of the existing 802.1q tag. This relies on the switch stripping off only the first 802.1q tag and leaving itself vulnerable to the second tag. This is not as common a method of VLAN hopping as using trunking.
To ensure you do not fall foul of a VLAN hopping attack, you must ensure that all your user ports are assigned as access mode ports. Any unused ports should be disabled and set as access mode ports by default.
To set a switch port to access mode, use the following configuration command from interface configuration mode:
Switch(config-if)# switchport mode access
By entering this command at the interface level, you switch the port into access mode; this port can never become a trunk port. It is a good practice to get into to ensure that all ports are configured in the correct mode. This should form part of your deployment strategy for all access layer switches in use within your organization.
When configuring a trunk port, the native VLAN need to be set to a unique VLAN, which is not routable or used elsewhere. To set a native VLAN on a trunk port, use the following configuration command from interface configuration mode:
Switch(config-if)# switchport trunk native vlan {number}
MAC Spoofing
MAC spoofing attacks are attacks launched by clients on a Layer 2 network. Attackers spoof their MAC address to perform a man-in-the-middle (MiTM) attack. In one common attack, the attacker pretends to be the default gateway and sends out a gratuitous Address Resolution Protocol (ARP) to the network so that users send their traffic through the attacker rather than the default gateway. The attacker then forwards user traffic to the real default gateway. An attacker on a fast enough host can capture and forward packets so that victims do not notice any change in their network access. Many tools available for download from the Internet, such as Ettercap, can accomplish such a task, and preventing such attacks is quite problematic.
One way to mitigate this threat is to use Port Security. For this to work, however, the maximum MAC address setting must be 1, and the support headache associated with using this setting can potentially be greater than the risk of this type of an attack occurring.