Network Security and Access Control
Security questions focus on what actually filters or authenticates traffic at the switch: ACLs, port security, 802.1X and AAA, plus the Layer 2 hardening features that stop snooping and spoofing.
ACLs
Standard ACLs match source only; extended ACLs match source, destination, protocol and port. Named ACLs are applied per interface and per direction, evaluated top-down, first match wins, with an implicit deny at the end. OS10 uses named extended lists such as ip access-list extended NAME with sequence numbers. ACLs are stateless: return traffic needs its own permit if both directions are filtered.
Identity and AAA
802.1X has supplicant, authenticator (the switch) and authentication server (RADIUS). MAB authenticates devices that cannot run a supplicant; guest VLANs give limited access. TACACS+ uses TCP 49 and encrypts the whole payload; RADIUS uses UDP 1812/1813 and encrypts only the password. Local fallback accounts prevent lockout if the server is unreachable.
Layer 2 hardening
DHCP snooping drops server replies on untrusted ports and builds a binding table; dynamic ARP inspection and IP source guard reuse that table to block spoofing. Port security limits MAC addresses per port, storm control limits broadcast rates, private VLANs isolate hosts, and control-plane policing protects the CPU. Restrict management to SSH in a management VRF or out-of-band network.
Worked example
Permit only 10.0.0.0/24 to reach 10.1.1.10 on TCP 443, deny everything else, applied inbound on the user VLAN SVI. The list needs an explicit permit for 10.0.0.0/24 to host 10.1.1.10 eq 443; the implicit deny handles the rest. If the same list is applied outbound on the server SVI, the return traffic must be permitted separately - the ACL keeps no session state.
Traps
Forgetting the implicit deny; applying an ACL in the wrong direction; marking the uplink to the DHCP server as untrusted; assuming TACACS+ and RADIUS provide the same encryption; leaving a permit-any rule at the top of a long ACL.