3 Most Commonly Configured Catalyst Switch Security Features

There are several security features that have been embedded in catalyst switch software. Many of which are, or should be, used as commonly as VLANs. Let’s take a look at the three most popular of these and their uses. Port Security – This is one of the most commonly used switch security feature of all. It is vital for protection against MAC spoofing and CAM table overflow attacks. This feature works by limiting an access port to allowing only a set number, usually 3-5, of MAC addresses per access port. It should not be used on trunk ports. It can dynamically learn the MAC addresses or you can statically configure them for things like routers that don’t change. Example IOS configuration: switchport port-security. Note that additional commands will be required. Storm Control – This popular feature allows a network to defend itself against broadcast, unicast, and multicast storms and denial of service attacks. The most popular method is broadcast storm control. It is configured using a percentage level that if exceeded will error disable the port. This feature can really save your bacon if you have a flaky NIC card on the network. Example IOS configuration: storm-control broadcast level 50.0 BPDU Guard – This feature is essential for ensuring that rogue switches, loop backed physical ports, and malicious users are not able to bring down spanning-tree and thus your network. It also prevents users from connecting rogue managed switches to the network. It works by error disabling any access port that it receives a BPDU on. It can be configured either globally or per-port. Usually it is configured globally as it only dynamically turns on when portfast is also active. Example IOS configuration: spanning-tree portfast bpduguard default Three other notable and popular switch security features are DHCP snooping, IP Source guard, and Dynamic ARP Inspection. For information on these and the previously discussed features check out the Cisco Infrastructure Protection best practices whitepaper here: http://www.cisco.com/application/pdf/en/us/guest/netsol/ns171/c649/ccmigration_09186a0080825564.pdf I’d like to hear from you what security features you enable on your production switches. What kinds of features would you like to see in the future? The opinions and information presented here are my personal views not those of my employeer.