Data Link Security

Introduction to Layer 2 Security

Firewalls, VPNs, and encryption protect data at higher layers while it travels across the internet. Security also covers the first access point to a local network: a physical switch port in an office, Wi-Fi in a coffee shop, or an Ethernet jack in a university dorm room. This connection point is handled by the Data Link Layer (Layer 2).

Layer 2 security controls who can connect to the local network and what they can do after access is granted. Without these controls, an unauthorized user could plug into an open port, launch further attacks, eavesdrop on traffic, or disrupt network services. Address controls, port authentication, and traffic filtering help limit these threats. Access controls do not replace encryption provided by other protocols.

Common Layer 2 Attacks

Basic Layer 2 protocols often do not authenticate the source of their information. Attacks can change address mappings, consume resources allocated to clients, or move traffic outside its intended segment. Attackers can exploit this property through the following attacks:

• MAC Spoofing: An attacker alters the MAC address of their device to impersonate a legitimate device on the network. This can bypass simple access controls and, in some conditions, help intercept traffic intended for the impersonated host.
• ARP Poisoning (ARP Spoofing): An attacker sends forged ARPmessages onto the network. The goal is to associate the attacker's MAC address with the IP address of another host, such as the default gateway (router). If neighboring devices accept the mapping, they may send traffic to the attacker instead of the legitimate destination, enabling a Man-in-the-Middle (MitM) attack.
• DHCP Starvation and Spoofing: The attack can occur in two stages. First, an attacker sends many DHCPrequests with fake MAC addresses and consumes addresses from the legitimate server's pool. The attacker then runs a rogue DHCP server that may provide clients with a malicious default gateway or DNS server and route their traffic through the attacker's machine.
• VLAN Hopping: An attack that allows a user on one VLAN to gain unauthorized access to traffic on another VLAN. A common cause is a misconfigured trunk port or unwanted frame tagging on a switch.

Port Security on a Switch

Port Securityis a feature available in some switch implementations. It limits the number of permitted MAC addresses on a port and can drop frames from unknown addresses. This limits simple unauthorized connections, but copying an allowed MAC address can bypass the control. The feature checks a frame's source address, so it does not replace user authentication or encryption.

How Port Security Learns Addresses

A switch port can be configured to learn and remember the MAC addresses of legitimate devices in several ways:

• Static Configuration: The network administrator manually enters the MAC addresses allowed on a given port. This provides the most control but is also the most labor-intensive method to manage.
• Dynamic Learning: The switch dynamically learns the MAC address of the first device(s) that connect to the port (up to a configured maximum). These addresses are stored in the MAC address table but are lost when the switch reboots.
• "Sticky" Learning: This is a hybrid approach. The switch dynamically learns MAC addresses and writes them to the running configuration as if they were statically configured. After the configuration is saved, this combines dynamic learning with persistent static entries.

What Happens During a Violation?

When a frame arrives on a port from an unknown MAC address and the limit of allowed addresses has been reached, the switch considers it a security violation and takes a pre-configured action. Exact mode names and reporting behavior depend on the vendor:

• Shutdown (Default in Cisco IOS): The port enters an error-disabled state and shuts down. An implementation may send an alert, such as an SNMP trap, to the network management station. The administrator must re-enable the port after investigating the incident.
• Restrict: The port drops frames from the violating, unknown MAC address and increments a security violation counter. Implementations may send an alert. The port remains active for permitted devices.
• Protect: The port silently drops frames from the violating MAC address. It does not increment a counter or send an alert, which makes violations harder to detect.

IEEE 802.1X Port-Based Network Access Control (PNAC)

Port Security relies on a MAC address that can be changed. IEEE 802.1X defines port-based network access control and uses EAP to authenticate a supplicant representing a user or device before granting network access. The standard supports mutual authentication for peers communicating through a controlled port, depending on the EAP method. It defines participant roles, while a backend server can use RADIUS for AAA.

Before a port is authorized, the authenticator controls data traffic while allowing the authentication exchange. A backend server can make the authentication and authorization decision.

The Three Roles in the 802.1X Architecture

The 802.1X process involves three distinct roles. Each has separate responsibilities:

The 802.1X Exchange: EAP over LAN (EAPOL)

The communication process includes the following steps. EAP is carried between the supplicant and authenticator through EAPOL, and it may be carried between the authenticator and backend server in RADIUS.

1. Initiation:When a supplicant's laptop is connected to a switch acting as the authenticator, the port is unauthorized and blocks normal traffic. In this exchange, the supplicant sends an "EAPOL-Start" message to begin the process.
2. Identity Request:The Authenticator responds with an "EAP-Request/Identity" packet, asking "Who are you?"
3. Identity Response: The Supplicant replies with its identity (e.g., username).
4. RADIUS Relay:The Authenticator takes this identity, packages it into a RADIUS "Access-Request" message, and forwards it to the Authentication Server.
5. The Challenge: The Authentication Server looks up the user and begins the selected authentication method through the Extensible Authentication Protocol (EAP). It might send a challenge, request a password, or start certificate validation. Confidentiality and protection of this exchange depend on the selected EAP method, while the Authenticator relays messages between the parties.
6. The Verdict:Once the EAP exchange is complete, the Authentication Server sends a final verdict back to the Authenticator: either a RADIUS "Access-Accept" or "Access-Reject" message. The response may also contain authorization attributes, depending on the server configuration.
7. Access Granted (or Denied):If the message is "Access-Accept", the Authenticator transitions the port to an authorized state, allowing normal data traffic to flow. The user is now on the network. If it's "Access-Reject", the port remains unauthorized.