Layer 2 security: DHCP snooping, DAI, storm control, RA guard and port security

Why this matters

Most attacks on a campus network do not start at the firewall. They start at a wall jack. Someone plugs in a home router that hands out addresses, a laptop runs a tool that answers every ARP request with its own MAC address, or a looped cable floods a VLAN with broadcasts. The access switch is the first device that sees any of this, and by default it trusts every port equally. A network technician who builds and supports access switches turns on the features in this lesson so that a switch port only does what the device on it should be doing.

When these features are missing, the symptoms land on the help desk as "the network is down". Users get addresses from a rogue server and lose the internet. Traffic is quietly copied through an attacker's laptop. A broadcast storm slows a whole floor. When the features are configured badly, the symptoms are just as real: clients stop getting leases, a printer with a static address goes silent, or a port shuts itself down. A junior engineer needs to know both sides, what each feature blocks and what it breaks when it is set up wrong.

The lesson

The five features here all run on the access switch and all work the same way at heart: the switch looks at traffic arriving on a port, compares it with what that port is allowed to send, and drops or acts on anything that does not fit. Two of them build on each other: DHCP snooping learns which address each host was given, and dynamic ARP inspection uses that knowledge. Port security, which works on its own, limits which MAC addresses may use a port at all. Edge-port configuration itself is in lesson 9, and the err-disabled state also appears with BPDU guard in lesson 12.

DHCP snooping

DHCP snooping protects clients from a rogue DHCP server: any device that answers DHCP requests without being the company's server. A rogue server can be an attack, handing out the attacker's address as the default gateway, or an accident, such as a small office router plugged in backwards. Either way, clients that take its offer stop working properly.

Snooping divides switch ports into two kinds.

• Trusted ports may carry DHCP server messages. Trust the uplink toward the real DHCP server, or toward the router that relays to it.
• Untrusted ports may carry only client messages. Once snooping is on, every port is untrusted until you say otherwise.

On an untrusted port the switch drops the messages that only a server sends: DHCPOFFER and DHCPACK (and DHCPNAK). Client messages such as DHCPDISCOVER and DHCPREQUEST are allowed in, because that is how clients ask for addresses. So a rogue server on an access port can hear requests, but its replies never reach anyone. Lesson 7 walks through the four-message exchange itself.

Snooping must be enabled globally and then per VLAN. Both commands are needed.

SW1(config)#ip dhcp snooping
SW1(config)#ip dhcp snooping vlan 10,30
SW1(config)#interface GigabitEthernet1/0/24
SW1(config-if)#description Uplink to R1
SW1(config-if)#ip dhcp snooping trust
SW1(config-if)#exit
SW1(config)#interface range GigabitEthernet1/0/1 - 22
SW1(config-if-range)#ip dhcp snooping limit rate 10

The last command is optional. It limits how many DHCP packets per second an untrusted port may send, which stops one host from flooding the server with requests. A port that exceeds it is err-disabled.

As clients get leases, the switch records each one in the DHCP snooping binding table: the client's MAC address, the IP address it was given, the lease time, the VLAN and the port. This table is the foundation for dynamic ARP inspection below.

SW1#show ip dhcp snooping binding
MacAddress          IpAddress        Lease(sec)  Type           VLAN  Interface
------------------  ---------------  ----------  -------------  ----  --------------------
00:50:56:A1:22:01   10.10.10.21      86213       dhcp-snooping   10    GigabitEthernet1/0/5
00:50:56:A1:22:02   10.10.10.22      85990       dhcp-snooping   10    GigabitEthernet1/0/6
Total number of bindings: 2

The option 82 trap. By default a Catalyst switch with snooping enabled inserts DHCP option 82 (relay agent information) into client requests, but it leaves the relay agent address (giaddr) set to zero, because the switch is not really a relay. A Cisco IOS or IOS XE router acting as the DHCP server on the same VLAN, with no relay in between, sees option 82 with a zero giaddr and drops the request. The symptom is that clients stopped getting leases the moment snooping was enabled, even though the uplink is trusted. The most direct fix on the switch is to stop inserting the option:

SW1(config)#no ip dhcp snooping information option

The alternative is on the router, with ip dhcp relay information trust-all, but the switch command is the one that addresses the cause where it was introduced. Trusting client ports is never the fix: it only lets rogue servers answer again.

Dynamic ARP inspection

ARP has no authentication. Any host can send an ARP reply claiming that the gateway's IP address belongs to its own MAC address, and the other hosts will believe it. This is ARP spoofing (or ARP poisoning), and it lets an attacker sit in the middle of conversations.

Dynamic ARP inspection (DAI) stops it. On untrusted ports, the switch checks the sender IP address and sender MAC address in every ARP packet against the DHCP snooping binding table. If the pair matches a binding on that port and VLAN, the packet is forwarded. If not, it is dropped and logged. Note what DAI does not use: not the MAC address table, which only records where a MAC was seen, and not anyone's ARP cache.

DAI is enabled per VLAN, and it has its own trust setting, separate from snooping's. Trust the uplinks and any port facing another switch or router.

SW1(config)#ip arp inspection vlan 10,30
SW1(config)#interface GigabitEthernet1/0/24
SW1(config-if)#ip arp inspection trust

Trusting a port for DHCP snooping has no effect on DAI, and the reverse is also true. An uplink usually needs both commands.

Static hosts. A printer or server with a manually configured address never sent DHCP messages, so it has no binding, and DAI drops its ARP packets. The printer stops reaching anything while DHCP clients carry on working. The fix that keeps the port protected is an ARP ACL that lists the known IP and MAC pair, applied with ip arp inspection filter:

SW1(config)#arp access-list STATIC-HOSTS
SW1(config-arp-nacl)#permit ip host 10.10.30.50 mac host 0050.56a1.3050
SW1(config-arp-nacl)#exit
SW1(config)#ip arp inspection filter STATIC-HOSTS vlan 30

Trusting the printer's port would also make it work, but it switches off the check for that port completely.

Rate limiting. DAI limits ARP on untrusted ports to 15 packets per second by default. A host running a network scan can send ARP requests much faster than that, and when it does the port is put into the err-disabled state. The log names the cause:

%SW_DAI-4-PACKET_RATE_EXCEEDED: 31 packets received in 963 milliseconds on Gi1/0/8.
%PM-4-ERR_DISABLE: arp-inspection error detected on Gi1/0/8, putting Gi1/0/8 in err-disable state

You can raise the limit per port with ip arp inspection limit rate 30, for example on a port with many hosts behind a small switch.

Storm control

A broadcast storm happens when broadcast frames multiply out of control, most often because of a loop that spanning tree did not block, or because a faulty network card transmits without stopping. Every host in the VLAN has to process every broadcast, so a storm can make a whole VLAN unusable.

Storm control watches the level of broadcast, multicast or unknown unicast traffic arriving on a port, measured over each one-second interval. You set a threshold as a percentage of the port's bandwidth (or in packets or bits per second). When traffic of that type crosses the threshold, the switch acts.

SW1(config)#interface GigabitEthernet1/0/15
SW1(config-if)#storm-control broadcast level 20.00
SW1(config-if)#storm-control multicast level 10.00

With no storm-control action command, the action is to filter: the switch drops frames of the traffic type that crossed the threshold until the level falls back below it. Other traffic types keep flowing. Two other actions can be added:

• storm-control action shutdown puts the port into the err-disabled state.
• storm-control action trap sends an SNMP trap (lesson 27) when a storm is detected.

SW1#show storm-control GigabitEthernet1/0/15 broadcast
Interface  Filter State   Upper        Lower        Current
---------  -------------  -----------  -----------  ----------
Gi1/0/15   Forwarding       20.00%       20.00%        0.42%

The Current column shows the measured level, here well under the threshold, so the filter state is Forwarding. During a storm it shows Blocking.

One point catches people out: storm control has no default threshold. It is off on every port until a level is configured on that interface. If a question says a port with no storm-control configuration was shut down by a flood, look for another cause.

RA guard

IPv6 hosts learn their default gateway and, with SLAAC, their prefix from router advertisements (RAs), which routers send to the all-nodes multicast address (lesson 4 covers SLAAC). Like ARP, RAs are not authenticated. If a user's device starts sending RAs, whether through malware or a misconfigured operating system feature, laptops on that VLAN may start using it as their IPv6 default gateway. Traffic then goes to the wrong place, or nowhere.

RA guard blocks router advertisements on ports where no router should be. You build a policy, give it a device role, and attach it to interfaces.

SW1(config)#ipv6 nd raguard policy HOSTS
SW1(config-nd-raguard)#device-role host
SW1(config-nd-raguard)#exit
SW1(config)#ipv6 nd raguard policy ROUTERS
SW1(config-nd-raguard)#device-role router
SW1(config-nd-raguard)#exit
SW1(config)#interface range GigabitEthernet1/0/1 - 22
SW1(config-if-range)#ipv6 nd raguard attach-policy HOSTS
SW1(config-if-range)#exit
SW1(config)#interface GigabitEthernet1/0/24
SW1(config-if)#ipv6 nd raguard attach-policy ROUTERS

A port with the host role drops every RA arriving on it. A port with the router role lets RAs through. The interface command is ipv6 nd raguard attach-policy. Do not confuse it with two similar commands: ipv6 dhcp guard attach-policy attaches a DHCPv6 guard policy, which filters DHCPv6 server messages (the IPv6 cousin of DHCP snooping), and ipv6 snooping attach-policy attaches an IPv6 snooping policy that builds a binding table.

Remember also that DAI cannot help here. DAI inspects IPv4 ARP only, and IPv6 has no ARP at all: it uses Neighbor Discovery, which is where RAs come from.

Port security

Port security limits which MAC addresses, and how many, may send frames into a port. It stops someone unplugging a desk phone and plugging in a laptop, or adding a small hub or switch to connect extra devices.

Port security only works on a port whose mode is set statically. On a port left in dynamic mode the switch rejects the command, so set switchport mode access first.

SW1(config)#interface GigabitEthernet1/0/7
SW1(config-if)#switchport mode access
SW1(config-if)#switchport access vlan 10
SW1(config-if)#switchport port-security

With only that last command, the defaults apply: a maximum of one secure MAC address, learned dynamically from the first frame, and the shutdown violation mode. So if a second device is connected through a hub, the port is err-disabled straight away.

Violation modes decide what happens when a frame arrives from a MAC address that is not allowed:

So when a port must drop unknown frames, record each violation and keep working for the authorised device, the command is switchport port-security violation restrict. Protect is the silent option, useful only when nobody needs to know.

Sticky learning saves addresses as they are learned:

SW1(config-if)#switchport port-security maximum 2
SW1(config-if)#switchport port-security mac-address sticky

The switch writes each learned address into the running configuration as a line such as switchport port-security mac-address sticky 0050.56a1.0707. That line survives a reload only if you save the running-config to the startup-config. If a switch forgets its sticky addresses after a power cut, the most likely reason is that nobody ran copy running-config startup-config.

Reading a violation. When a shutdown-mode port sees an unknown MAC, the log and the show commands agree:

%PORT_SECURITY-2-PSECURE_VIOLATION: Security violation occurred, caused by MAC address 0050.56a1.9999 on port GigabitEthernet1/0/9.
%PM-4-ERR_DISABLE: psecure-violation error detected on Gi1/0/9, putting Gi1/0/9 in err-disable state

SW1#show port-security interface GigabitEthernet1/0/9
Port Security              : Enabled
Port Status                : Secure-shutdown
Violation Mode             : Shutdown
Aging Time                 : 0 mins
Aging Type                 : Absolute
SecureStatic Address Aging : Disabled
Maximum MAC Addresses      : 1
Total MAC Addresses        : 1
Configured MAC Addresses   : 0
Sticky MAC Addresses       : 0
Last Source Address:Vlan   : 0050.56a1.9999:10
Security Violation Count   : 1

SW1#show interfaces status err-disabled
Port      Name               Status       Reason               Err-disabled Vlans
Gi1/0/9                      err-disabled psecure-violation

Recovering the port. Removing the unauthorised device is not enough. An err-disabled port stays down until an administrator bounces it:

SW1(config)#interface GigabitEthernet1/0/9
SW1(config-if)#shutdown
SW1(config-if)#no shutdown

Or, if you configured it in advance, errdisable recovery brings it back after a timer:

SW1(config)#errdisable recovery cause psecure-violation
SW1(config)#errdisable recovery interval 300

Clearing the MAC address table does not lift the err-disabled state. The same two recovery methods apply to ports err-disabled by DAI rate limits, DHCP snooping rate limits, storm control shutdown or BPDU guard; only the cause name changes.

What the exam is really asking

• Which port to trust. For DHCP snooping, trust the uplink toward the real server, never the access ports where clients sit. Every port is untrusted by default once snooping is on.
• Which messages are dropped. On untrusted ports snooping drops server messages (OFFER, ACK), not client ones (DISCOVER, REQUEST).
• Snooping on, leases stop. With a trusted uplink and an IOS DHCP server on the same VLAN, suspect option 82 and use no ip dhcp snooping information option.
• What DAI checks against. The DHCP snooping binding table, not the MAC address table. Static hosts need an ARP ACL with ip arp inspection filter. DAI trust is separate from snooping trust.
• Default numbers. DAI: 15 ARP packets per second on untrusted ports, then err-disabled. Port security: maximum 1, mode shutdown. Storm control: no default threshold at all.
• Storm control's default action is to filter (drop that traffic type until it falls), not to shut the port.
• RA guard vs DAI. RAs are IPv6; DAI is IPv4 ARP only. The command is ipv6 nd raguard attach-policy, not ipv6 dhcp guard.
• Protect vs restrict vs shutdown. Only restrict and shutdown log and count; only shutdown takes the port down.
• Sticky is in the running-config. Save it or lose it.
• Err-disabled recovery is shutdown then no shutdown, or errdisable recovery configured for that cause.