I85PREP
⌘ K
JNCIP-SEC study materials
JNCIP-SEC study resources

JNCIP-SEC: Layer 2 Security

JNCIP-SEC · Work through your exam, one topic at a time.

All guide sections

Layer 2 Security

Layer 2 security on the SRX covers both switching-mode deployments and the L2 hardening that protects access ports. The exam expects you to build VLANs and IRB interfaces, run the SRX as a transparent firewall, and explain what DHCP snooping, dynamic ARP inspection and MAC limits actually stop.

Core rules

  • Switching configuration: set interfaces ge-0/0/1 unit 0 family ethernet-switching interface-mode access vlan members v100; trunk ports use interface-mode trunk with vlan members [v100 v200] or all.
  • Inter-VLAN routing needs an IRB: set vlans v100 vlan-id 100, set vlans v100 l3-interface irb.100, set interfaces irb unit 100 family inet address 10.100.0.1/24. The IRB unit is what you place in a security zone and write policy against.
  • Transparent mode: two interfaces carry the same VLAN but sit in different zones; the SRX bridges frames and enforces policy without routing, so an inline device filters between switch and router with no readdressing.
  • Hardening: MAC limiting (set switch-options interface ge-0/0/1.0 interface-mac-limit 5 packet-action drop) caps learned MACs per port; MAC move limiting stops a MAC flapping between ports; DHCP snooping builds a trusted binding table and blocks rogue DHCP servers on untrusted ports; dynamic ARP inspection validates ARP against those bindings; storm control drops excess broadcast, multicast and unknown-unicast.
  • Verify with show ethernet-switching table, show vlans, show arp, and interface statistics.

Worked example

Users on VLAN 100 report drops. show ethernet-switching table shows one MAC alternating between ge-0/0/5 and ge-0/0/9 every few seconds - a loop from a user's unmanaged switch. With mac-move-limit 3 packet-action drop on the access ports, the offending MAC is dropped instead of poisoning the table, and the rest of the VLAN keeps working while you chase the loop.

Traps

  • Mixing family ethernet-switching and family inet on the same unit.
  • Deploying dynamic ARP inspection before DHCP snooping; with no bindings, valid ARP is dropped.
  • Believing MAC limits remove existing table entries - they only affect new learning.
  • Assuming transparent-mode interfaces must be in the same zone; policy only exists between zones.