Basic Security
What you must understand
Security fundamentals start with the AAA triad: authentication (who), authorization (what they may do), and accounting (what they did). Know the difference between 802.1X port-based access control and MAC authentication. In 802.1X the supplicant authenticates to an authenticator (the switch) which relays to a RADIUS server. Until authentication succeeds, the port is typically in an unauthorized state; a common design uses a guest or restricted VLAN for failures.
Understand port security: limiting learned MAC addresses per port, and the violation actions protect (drop), restrict (drop and log), and shutdown. Know DHCP snooping, which builds a trusted binding table and blocks rogue DHCP servers on untrusted ports, and dynamic ARP inspection, which validates ARP against that binding table. These are the standard defenses against DHCP starvation and ARP spoofing.
Know management-plane hygiene: strong credentials, SSH instead of Telnet, and restricting management access. Understand that WPA2/WPA3 protect wireless with encryption and that WPA3 adds SAE to resist offline dictionary attacks. Segmentation with VLANs and ACLs limits lateral movement.
Traps to expect
- Mixing up authentication and authorization.
- Thinking port security protects against IP spoofing (it binds MAC, not IP).
- Forgetting that DHCP snooping must be enabled on the correct trusted uplink.
- Assuming DAI works without DHCP snooping bindings (it needs them, or static entries).
- Believing 802.1X encrypts traffic; it controls access, encryption is separate.
Rule of thumb
Map each attack to its control: rogue DHCP to DHCP snooping, ARP spoofing to DAI, MAC flooding to port security, unauthorized access to 802.1X.
Worked example
Users report intermittent loss of connectivity and a duplicate gateway. Suspect ARP spoofing. Enable DHCP snooping to build bindings, mark the real uplink trusted, then enable DAI on user VLANs so invalid ARP replies are dropped.