Network Security and Access Control
Access-layer security centers on port authentication and traffic control: 802.1X (supplicant/authenticator/authentication server), MAC authentication, and RADIUS/AAA. Combine with port security (limit MACs, sticky learning, violation actions), DHCP snooping (block rogue servers), Dynamic ARP Inspection (validate ARP against the snooping table), and IP Source Guard. Management-plane hardening: SSH, AAA, ACLs on VTY, and disabling unused services.
Traps: (1) 802.1X needs a RADIUS server; without it, fallback (MAB, guest VLAN) behavior matters. (2) DHCP snooping trusted ports must face the legitimate DHCP server/uplink-untrusted ports drop server replies. (3) DAI depends on DHCP snooping being enabled. (4) Port-security violation modes: protect (drop), restrict (drop+log), shutdown (err-disable). (5) ACL direction and implicit deny-order matters.
Rule of thumb: enable DHCP snooping before DAI; mark only uplink/server ports trusted.
Worked example: A rogue DHCP server on an access port hands out bad gateways. Enable DHCP snooping, set uplinks trusted, leave access ports untrusted. Now OFFER/ACK from the rogue port is dropped; clients keep the legitimate lease.