Securing a network is an endless task. Every day there are new scripts and exploits, new vulnerabilities, and new methods to gain access to your network. Our job as Cisco administrators is to stay ahead of the game as much as possible and make it as difficult as possible to gain access.

As discussed in Chapter 4, “General Network Security,” the basis of any good security implementation is a thorough security policy. Switched networks must be a pivotal piece of that security policy; however, they are typically the most overlooked. The fact that the LAN is tucked away inside your network provides a false sense of security, especially because some of your biggest threats might be the users attached to the switched network. This chapter examines how to secure access to the Cisco devices in your LAN as well as the traffic that flows through it.

Similar to troubleshooting, our first layer of defense for securing the switched network should start at the Physical layer. Specifically, we need to secure access to the physical switch itself and the cables that are connected to it. It doesn’t take a skilled attacker to physically destroy a switched network to which he or she has complete access.

With that being said, the first and probably most critical step of securing your network is to ensure that the switches themselves are secured in a cool room in which only you or those authorized have access. If users have physical access to the switches, they can easily console into the switch and perform a password-recovery exercise (easily found on the Internet) just by repowering the switch and holding down a button during power-up. Even unintentional attacks such as custodial staff unplugging your switches to run the vacuum can occur easily if not secured correctly. If you can, also make sure that the Ethernet cabling between the switches and end devices is not in plain sight and therefore can’t be easily damaged. You don’t want the last act by a fired employee to be taking down your entire network by ripping out your existing wiring.

After we have ensured that the switch is physically secured, the next layer of defense to implement is securing terminal access to the switch so that attackers cannot perform reconnaissance or manipulate configurations. Because there are several ways to gain access to the Cisco IOS, due diligence is required to ensure that all terminal connections are secured.

To start, the first logical terminal access to secure is the console and auxiliary port. Many might ask why, because we already physically secured the switch. To answer a question with a question, would you have an account at a bank that leaves your money out on a table because they have an alert security guard standing at the door? A layered defensive approach entails having security measures at each step of the way so that attackers will have many obstacles in their way in achieving their objective.

To secure access to the console and aux port, the simplest defense you can use is securing them with a password. Just as in router configurations, this is achieved in the line configuration using the password command. It is also a good idea to make sure that your passwords are strong passwords containing at least eight characters and that they have a combination of numbers, symbols, and lower and uppercase letters:

Switch(config)# line console 0
Switch(config-line)# login
Switch(config-line)# password EggsAmKr@m
Switch(config-line)# exit
Switch(config)# line auxiliary 0
Switch(config-line)# login
Switch(config-line)# password EggsAmPr3p

What’s more, you can create a local username and password combination that is stored in the configuration. This username and password will be required to be entered when someone attaches to the console and gets an EXEC prompt. The only difference in the configuration is that you no longer need to specify a password in the line configuration, because you achieved that in defining the username and password combination, and you also must use the keyword local in the login command. This keyword tells the IOS to use the local username and password combination that can be found in the configuration:

Switch(config)# username jchambers password Sysco-Prez
Switch(config)# line console 0
Switch(config-line)# login local
Switch(config-line)# exit
Switch(config)# line auxiliary 0
Switch(config-line)# login local

Now, when someone attaches to the console or aux port, he or she is prompted for a username and password, such as the following:

Press RETURN to get started.
User Access Verification

Username:jchambers
Password:
Switch>

Switch(config)# line vty 0 15
Switch(config-line)# transport input SSH

Feeling satisfied with securing access to the physical switch and cables as well as access to the Catalyst switch IOS, our next step on our secure ladder is to get to the core of our switching functions and secure the possible vulnerabilities that occur at the Data Link layer.

The transparent functions that our switches perform, such as MAC address learning and forwarding, are taken for granted because they are just that: transparent. Consequently, these are the most overlooked aspects of switch security today, because we naturally assume that the default behavior of the switch’s design is how it should be. Any thought of securing that behavior goes against the switch’s basic operations. In the following sections, you will see that although the extra configuration steps might involve slightly more work, the end result is that you won’t lose sleep wondering when the next attack might cause your cell phone to go off.

Switch(config-if)# switchport port-security
Switch(config-if)# switchport port-security maximum 10

Switch(config-if)# switchport port-security violation {protect | restrict | shutdown}

Switch(config)# interface fastethernet 0/2
Switch(config-if)# switchport port-security
Switch(config-if)# switchport port-security mac-address FA23.239B.2349

Switch# show port-security interface fa0/2
Port Security                        : Enabled
Port Status                          : Secure-up
Violation Mode                       : Shutdown
Aging Time                           : 0 mins
Aging Type                           : Absolute
SecureStatic Address Aging           : Disabled
Maximum MAC Addresses                : 1
Total MAC Addresses                  : 1
Configured MAC Addresses             : 1
Sticky MAC Addresses                 : 0
Last Source Address                  : fa23.239b.2349
Security Violation Count             : 0

Switch# show port-security address
          Secure Mac Address Table
-------------------------------------------------------------------
Vlan    Mac Address       Type                Ports   Remaining Age
                                                         (mins)
----    -----------       ----                -----   -------------
   1    fa23.239b.2349    SecureConfigured       Fa0/2       -
-------------------------------------------------------------------
Total Addresses in System (excluding one mac per port)     : 0
Max Addresses limit in System (excluding one mac per port) : 1024

Switch# show port-security address
          Secure Mac Address Table
-------------------------------------------------------------------
Vlan    Mac Address       Type                Ports   Remaining Age
                                                         (mins)
----    -----------       ----                -----   -------------
   1    fa23.239b.2349    SecureDynamic       Fa0/2       -
-------------------------------------------------------------------
Total Addresses in System (excluding one mac per port)     : 0
Max Addresses limit in System (excluding one mac per port) : 1024

Securing a switched network entails trying to protect all Layer 1 aspects of the switch, including access to the IOS itself. In addition, it is imperative to secure the switch’s Layer 2 operations so that an attacker doesn’t interrupt or damage the switched network.

Securing the Physical layer entails ensuring that the switch and its cables are in a secure environment where users cannot inflict damage on them. This step also gives added protection from users gaining console access to the switch to gain information to attack the network or attack or manipulate the switch itself. Leveraging the IOS’s internal security measures such as logins and passwords for terminal access is also ideal in building a layered defense. When possible, it is also recommended that you use SSH instead of Telnet for remote access to the IOS, because the communications between the management computer and the switch are secured.

Data Link layer security involves securing individual ports using port security. Port security protects ports by defining a maximum number of MAC addresses that are allowed to be dynamically learned on an individual port. You can also manually specify the MAC address(es) that are allowed to be present in the source address of the Ethernet frame when entering that port. This can be a single static configured MAC address, or you can configure sticky learning, and the addresses will be dynamically added to the configuration. When a port security violation occurs, the default action is to disable the interface. When this occurs, you have to shut down the interface and administratively bring it back up. You can configure the switch port to just report the violation (restrict), or you can reject frames from nonsecure MAC addresses until the number of MAC addresses falls under the limit (protect).

In addition, CDP reveals potentially dangerous information in its multicasts; thus, it is recommended that you disable CDP globally or on interfaces that do not require it.