Port Security Flashcards
What is Port Security in Cisco switches?
A Layer 2 security feature that restricts input to an interface by limiting and identifying MAC addresses
What command enables Port Security on a switchport?
switchport port-security
What are the three violation modes in Port Security?
Protect; Restrict; Shutdown
What does the Protect violation mode do?
Drops packets with unknown source MAC addresses
What does the Restrict violation mode do?
Drops packets and increments the security violation counter
What does the Shutdown violation mode do?
Err-disables the port upon a violation
How do you enable a port as an access port?
switchport mode access
What command sets the maximum number of MAC addresses on a port?
switchport port-security maximum [number]
What command sets a specific MAC address for port security?
switchport port-security mac-address [mac-address]
What command allows dynamically learned MAC addresses to be saved?
switchport port-security mac-address sticky
What is DHCP Snooping?
A security feature that acts like a firewall between untrusted hosts and trusted DHCP servers
What does DHCP Snooping prevent?
Rogue DHCP servers from assigning IP addresses
What is a trusted port in DHCP Snooping?
A port that allows DHCP server responses
What is an untrusted port in DHCP Snooping?
A port that should only receive DHCP requests from clients
What table does DHCP Snooping build?
The DHCP Snooping Binding Table
What command enables DHCP Snooping globally?
ip dhcp snooping
What command enables DHCP Snooping for a VLAN?
ip dhcp snooping vlan <vlan-id></vlan-id>
What command marks an interface as trusted for DHCP Snooping?
ip dhcp snooping trust
What command limits DHCP messages on a port?
ip dhcp snooping limit rate <rate></rate>
What is Dynamic ARP Inspection (DAI)?
A security feature that validates ARP packets in a network
What attack does DAI prevent?
ARP Spoofing/Poisoning
What does DAI use to validate ARP packets?
The DHCP Snooping Binding Table
Which ports are trusted in DAI?
Ports where ARP replies are not validated (usually connected to other switches or DHCP servers)
Which ports are untrusted in DAI?
Ports that must have ARP replies validated (usually connected to clients)
