JNCIS-ENT: Layer 2 Security

The secure access port toolkit

Layer 2 attacks target ARP, DHCP, MAC tables, and broadcast capacity, so Junos exposes a matching set of features. DHCP snooping (examine-dhcp on a VLAN) builds a binding table of MAC, IP, lease, and port. Dynamic ARP inspection (arp-inspection) uses that table to drop forged ARP replies, which means DAI silently does nothing if snooping is not enabled first. Ports facing the DHCP server or the uplink are marked trusted; access ports are untrusted by default. MAC limiting caps learned addresses per interface with an action of drop, log, or shutdown, and MAC move limiting catches a station that keeps appearing on different ports - the signature of a loop or spoof.

Other controls

• 802.1X: set protocols dot1x authenticator interface ge-0/0/5.0 supplicant single, with a RADIUS server profile and guest VLAN fallback.
• Storm control: storm-control limits broadcast, multicast, or unknown unicast in kbps or percent, with an action of drop (default) or shutdown plus a recovery timeout.
• MACsec provides hop-by-hop encryption on point-to-point links; it is not end-to-end like IPsec.
• Static and allowed MAC lists pin known devices.

Traps

• Enabling DAI without DHCP snooping, or trusting the wrong port.
• Assuming MAC limiting stops a loop - it limits learning, it does not prevent forwarding.
• Confusing ELS (switch-options) and non-ELS (ethernet-switching-options) command trees, and forgetting that the action must be set explicitly or the default applies.

Worked example

To stop ARP spoofing on VLAN 100: enable examine-dhcp on the VLAN, mark the uplink dhcp-trusted, then enable arp-inspection on the VLAN. Verify with the snooping binding table before blaming attackers for a misconfiguration.