WEBVTT

1
00:00.000 --> 00:00.740 align:middle line:84%


2
00:00.740 --> 00:02.180 align:middle line:84%
Hello and welcome back.

3
00:02.180 --> 00:04.700 align:middle line:90%
If you and I were going out
to a job site to do some work

4
00:04.700 --> 00:07.240 align:middle line:90%
and we had some tools that we
were going to bring with us,

5
00:07.240 --> 00:09.060 align:middle line:90%
we'd want to make
sure, before we go,

6
00:09.060 --> 00:10.320 align:middle line:84%
that we brought all our tools.

7
00:10.320 --> 00:11.630 align:middle line:90%
So we'd want to do
a quick inventory.

8
00:11.630 --> 00:13.505 align:middle line:90%
And in this video, that's
what I'd like to do

9
00:13.505 --> 00:16.440 align:middle line:90%
is a quick inventory of many
of the Layer 2 security tools

10
00:16.440 --> 00:19.180 align:middle line:90%
that we have to work
with in a Cisco Network.

11
00:19.180 --> 00:20.660 align:middle line:90%
And let's use this
network topology

12
00:20.660 --> 00:22.210 align:middle line:90%
as a backdrop for
this discussion.

13
00:22.210 --> 00:24.508 align:middle line:90%
And let's imagine that
you and I are consultants

14
00:24.508 --> 00:26.300 align:middle line:90%
and we're going into
a customer and they're

15
00:26.300 --> 00:28.242 align:middle line:90%
asking us, "OK, if
we hire you, what

16
00:28.242 --> 00:30.200 align:middle line:90%
are some of the things
you're going to consider
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

16
00:28.242 --> 00:30.200 align:middle line:90%
are some of the things
you're going to consider

17
00:30.200 --> 00:32.000 align:middle line:84%
regarding security at Layer 2?"

18
00:32.000 --> 00:34.430 align:middle line:90%
Now together, let's make a
list of some of those things

19
00:34.430 --> 00:35.730 align:middle line:84%
that we should consider.

20
00:35.730 --> 00:37.130 align:middle line:84%
So let's start with some basics.

21
00:37.130 --> 00:38.588 align:middle line:90%
One of the basic
things we're going

22
00:38.588 --> 00:40.820 align:middle line:90%
to want to do for security
is network segmentation

23
00:40.820 --> 00:42.200 align:middle line:84%
at the VLAN level.

24
00:42.200 --> 00:43.940 align:middle line:90%
And so with every
Layer 2 VLAN, there's

25
00:43.940 --> 00:46.502 align:middle line:90%
also a Layer 3
associated IP network.

26
00:46.502 --> 00:48.710 align:middle line:90%
And then we can control
access between those networks

27
00:48.710 --> 00:50.480 align:middle line:90%
with firewalls or
routers between them.

28
00:50.480 --> 00:52.160 align:middle line:90%
But we can also go
one step further

29
00:52.160 --> 00:55.520 align:middle line:90%
and use a technology such as
TrustSec, which is fabulous.

30
00:55.520 --> 00:56.960 align:middle line:84%
And that allows two devices.

31
00:56.960 --> 00:58.790 align:middle line:90%
Even if they're
in the same VLAN,

32
00:58.790 --> 01:00.710 align:middle line:90%
we can control the
traffic back and forth
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

32
00:58.790 --> 01:00.710 align:middle line:90%
we can control the
traffic back and forth

33
01:00.710 --> 01:03.432 align:middle line:90%
between those two devices based
on our TrustSec configuration,

34
01:03.432 --> 01:04.849 align:middle line:90%
which, in the
background, is going

35
01:04.849 --> 01:07.340 align:middle line:90%
to involve Identity
Services Engine and then

36
01:07.340 --> 01:08.840 align:middle line:84%
policies that drive all that.

37
01:08.840 --> 01:10.940 align:middle line:90%
And the concept here
is segmentation,

38
01:10.940 --> 01:13.430 align:middle line:90%
or in the case of TrustSec,
micro-segmentation

39
01:13.430 --> 01:14.480 align:middle line:84%
within a VLAN.

40
01:14.480 --> 01:17.630 align:middle line:90%
Another Layer 2 security
option would be DHCP snooping.

41
01:17.630 --> 01:19.953 align:middle line:90%
And that way if Bob, on
this computer, plugs in

42
01:19.953 --> 01:21.620 align:middle line:90%
and he's running some
malicious software

43
01:21.620 --> 01:23.750 align:middle line:90%
or he brings a
little home router

44
01:23.750 --> 01:26.630 align:middle line:90%
and plugs it in that tries
to become a DHCP server,

45
01:26.630 --> 01:29.320 align:middle line:90%
by just doing DHCP
snooping in these VLANs,

46
01:29.320 --> 01:33.530 align:middle line:90%
the server's messages, like
Offers and Acknowledgements,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

46
01:29.320 --> 01:33.530 align:middle line:90%
the server's messages, like
Offers and Acknowledgements,

47
01:33.530 --> 01:36.440 align:middle line:90%
won't be allowed in unless
that's a DHCP snooping

48
01:36.440 --> 01:39.050 align:middle line:90%
trusted port, which by default,
if we've been able to feature,

49
01:39.050 --> 01:39.942 align:middle line:84%
it's not.

50
01:39.942 --> 01:41.900 align:middle line:90%
Another tool that we can
leverage DHCP snooping

51
01:41.900 --> 01:45.020 align:middle line:90%
in the database it builds would
be Dynamic ARP Inspection.

52
01:45.020 --> 01:46.520 align:middle line:90%
And that just makes
sure that nobody

53
01:46.520 --> 01:48.545 align:middle line:90%
is lying about their
Layer 3 to Layer

54
01:48.545 --> 01:50.547 align:middle line:84%
2 mappings in ARP messages.

55
01:50.547 --> 01:52.380 align:middle line:90%
So anything that is
bogus, we can drop right

56
01:52.380 --> 01:53.930 align:middle line:90%
at the edge of
the switch, and it

57
01:53.930 --> 01:55.700 align:middle line:90%
doesn't get into
the network to muck

58
01:55.700 --> 01:57.730 align:middle line:90%
with or manipulate
somebody else.

59
01:57.730 --> 02:00.472 align:middle line:90%
And we can also do the classic
of port security, which
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

59
01:57.730 --> 02:00.472 align:middle line:90%
And we can also do the classic
of port security, which

60
02:00.472 --> 02:02.180 align:middle line:90%
can control how many
MAC addresses can we

61
02:02.180 --> 02:03.552 align:middle line:84%
learn on an individual port.

62
02:03.552 --> 02:05.510 align:middle line:90%
We can also hard code
what those addresses are.

63
02:05.510 --> 02:07.340 align:middle line:90%
And with port security,
we can specify

64
02:07.340 --> 02:09.252 align:middle line:90%
what those MAC
addresses are, and then

65
02:09.252 --> 02:11.210 align:middle line:90%
any device that has a
different Layer 2 address

66
02:11.210 --> 02:14.660 align:middle line:90%
won't be allowed to send frames
in because of port security.

67
02:14.660 --> 02:17.270 align:middle line:90%
Also, on switches, we can
also have access control lists

68
02:17.270 --> 02:18.290 align:middle line:84%
on switches.

69
02:18.290 --> 02:19.880 align:middle line:90%
As a general
precaution at Layer 2,

70
02:19.880 --> 02:22.550 align:middle line:90%
we'd also want to disable
DTP, Dynamic Trunk

71
02:22.550 --> 02:24.540 align:middle line:84%
Protocol and any unused ports.

72
02:24.540 --> 02:26.660 align:middle line:90%
In fact, the default
behavior, what we should do

73
02:26.660 --> 02:30.738 align:middle line:90%
is set up all of our ports as
access ports to a bogus VLAN.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

73
02:26.660 --> 02:30.738 align:middle line:90%
is set up all of our ports as
access ports to a bogus VLAN.

74
02:30.738 --> 02:32.780 align:middle line:90%
And that way, if that port
isn't being configured

75
02:32.780 --> 02:34.880 align:middle line:90%
for use, an
attacker, or somebody

76
02:34.880 --> 02:36.890 align:middle line:90%
else who connects to
that port, gets access

77
02:36.890 --> 02:38.180 align:middle line:84%
to virtually nowhere.

78
02:38.180 --> 02:40.820 align:middle line:90%
And because it's an access
port, it's not willing to trunk.

79
02:40.820 --> 02:43.680 align:middle line:90%
So that's a quick review of
a few of the Layer 2 security

80
02:43.680 --> 02:44.180 align:middle line:84%
options.

81
02:44.180 --> 02:46.400 align:middle line:90%
And what I'd like to do
further in this set of videos

82
02:46.400 --> 02:48.470 align:middle line:90%
is talk about a
couple more, including

83
02:48.470 --> 02:51.770 align:middle line:90%
storm control and a couple
of Spanning Tree Protocol

84
02:51.770 --> 02:52.880 align:middle line:84%
protections.

85
02:52.880 --> 02:55.130 align:middle line:90%
And that would include, among
other things, root guard

86
02:55.130 --> 02:56.403 align:middle line:84%
and BPDU guard.

87
02:56.403 --> 02:58.320 align:middle line:90%
And as we continue through
this set of videos,

88
02:58.320 --> 03:00.510 align:middle line:90%
we're going to elaborate
more on those as well.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

88
02:58.320 --> 03:00.510 align:middle line:90%
we're going to elaborate
more on those as well.

89
03:00.510 --> 03:01.885 align:middle line:90%
So I'll see you
in the next video

90
03:01.885 --> 03:03.560 align:middle line:90%
as we continue this
discussion about how

91
03:03.560 --> 03:06.110 align:middle line:90%
we can protect our
environment at Layer 2

92
03:06.110 --> 03:07.220 align:middle line:84%
on our Catalyst switches.

93
03:07.220 --> 03:08.512 align:middle line:84%
I'll see you in the next video.

94
03:08.512 --> 03:10.730 align:middle line:90%
Meanwhile, I hope this has
been informative for you.

95
03:10.730 --> 03:14.020 align:middle line:90%
And I'd like to thank
you for viewing.