1© 2005 Cisco Systems, Inc. All rights reserved.10849_Icons_May2005 Cisco Public

L2 Security Issues for small and medium enterprise

Joffre Pesántez V. Ing.

CCNA – CCDA – CCDP

CCNP – Comp Tia Linux +

2© 2005 Cisco Systems, Inc. All rights reserved. 10849_Icons_May2005 Cisco Public

AGENDA

• Ataques comunes en Capa 2

• Asegurando sus equipos de Capa 2

3© 2005 Cisco Systems, Inc. All rights reserved. 10849_Icons_May2005 Cisco Public

Ataques comunes en Capa 2

4© 2005 Cisco Systems, Inc. All rights reserved. 10849_Icons_May2005 Cisco Public

Ataques Comunes en Capa 2

• MAC Attacks (CAM Table Overflow)

• DHCP Attacks

• ARP Attacks

• Spoofing Attacks

• Power over Ethernet Attack

• VLAN hopping

• General Countermeasures

5© 2005 Cisco Systems, Inc. All rights reserved. 10849_Icons_May2005 Cisco Public

Mac Attacks

6© 2005 Cisco Systems, Inc. All rights reserved. 10849_Icons_May2005 Cisco Public

CAM Overview

7© 2005 Cisco Systems, Inc. All rights reserved. 10849_Icons_May2005 Cisco Public

Poblando la Tabla CAM (1)

8© 2005 Cisco Systems, Inc. All rights reserved. 10849_Icons_May2005 Cisco Public

Poblando la Tabla CAM (2)

9© 2005 Cisco Systems, Inc. All rights reserved. 10849_Icons_May2005 Cisco Public

Poblando la Tabla CAM (3)

10© 2005 Cisco Systems, Inc. All rights reserved. 10849_Icons_May2005 Cisco Public

CAM Overflow

11© 2005 Cisco Systems, Inc. All rights reserved. 10849_Icons_May2005 Cisco Public

CAM Overflow: Macof tool

12© 2005 Cisco Systems, Inc. All rights reserved. 10849_Icons_May2005 Cisco Public

CAM Overflow: Macof tool

13© 2005 Cisco Systems, Inc. All rights reserved. 10849_Icons_May2005 Cisco Public

Mac Flooding using macof

14© 2005 Cisco Systems, Inc. All rights reserved. 10849_Icons_May2005 Cisco Public

Mack Attack: Contramedidas

15© 2005 Cisco Systems, Inc. All rights reserved. 10849_Icons_May2005 Cisco Public

MAC Attack: Contramedidas

16© 2005 Cisco Systems, Inc. All rights reserved. 10849_Icons_May2005 Cisco Public

MAC Attack: Contramedidas

17© 2005 Cisco Systems, Inc. All rights reserved. 10849_Icons_May2005 Cisco Public

DHCP Attacks

18© 2005 Cisco Systems, Inc. All rights reserved. 10849_Icons_May2005 Cisco Public

DHCP Overview

19© 2005 Cisco Systems, Inc. All rights reserved. 10849_Icons_May2005 Cisco Public

DHCP Attack: Starvation

20© 2005 Cisco Systems, Inc. All rights reserved. 10849_Icons_May2005 Cisco Public

Countermeasures: Port Security

21© 2005 Cisco Systems, Inc. All rights reserved. 10849_Icons_May2005 Cisco Public

DHCP Attack: Rogue DHCP Server

22© 2005 Cisco Systems, Inc. All rights reserved. 10849_Icons_May2005 Cisco Public

Contramedida: VLAN access-list

23© 2005 Cisco Systems, Inc. All rights reserved. 10849_Icons_May2005 Cisco Public

Contramedida: DHCP Snooping

24© 2005 Cisco Systems, Inc. All rights reserved. 10849_Icons_May2005 Cisco Public

Contramedidas: DHCP Snooping

25© 2005 Cisco Systems, Inc. All rights reserved. 10849_Icons_May2005 Cisco Public

ARP Attacks

http://www.oxid.it/downloads/apr-intro.swf

26© 2005 Cisco Systems, Inc. All rights reserved. 10849_Icons_May2005 Cisco Public

ARP Attacks

27© 2005 Cisco Systems, Inc. All rights reserved. 10849_Icons_May2005 Cisco Public

Contramedidas: Dynamic ARP Inspection

28© 2005 Cisco Systems, Inc. All rights reserved. 10849_Icons_May2005 Cisco Public

Contramedidas: DAI

29© 2005 Cisco Systems, Inc. All rights reserved. 10849_Icons_May2005 Cisco Public

Contramedidas: DAI

30© 2005 Cisco Systems, Inc. All rights reserved. 10849_Icons_May2005 Cisco Public

Contramedidas: DAI

31© 2005 Cisco Systems, Inc. All rights reserved. 10849_Icons_May2005 Cisco Public

Contramedidas: DAI

32© 2005 Cisco Systems, Inc. All rights reserved. 10849_Icons_May2005 Cisco Public

Contramedidas: DAI

33© 2005 Cisco Systems, Inc. All rights reserved. 10849_Icons_May2005 Cisco Public

Spoofing Attack

34© 2005 Cisco Systems, Inc. All rights reserved. 10849_Icons_May2005 Cisco Public

Spoofing Attack

35© 2005 Cisco Systems, Inc. All rights reserved. 10849_Icons_May2005 Cisco Public

Contramedida: IP Source Guard

36© 2005 Cisco Systems, Inc. All rights reserved. 10849_Icons_May2005 Cisco Public

Contramedida: IP Source Guard

37© 2005 Cisco Systems, Inc. All rights reserved. 10849_Icons_May2005 Cisco Public

Contramedida: IP Source Guard

38© 2005 Cisco Systems, Inc. All rights reserved. 10849_Icons_May2005 Cisco Public

Sumario

39© 2005 Cisco Systems, Inc. All rights reserved. 10849_Icons_May2005 Cisco Public

Spanning Tree Attack

40© 2005 Cisco Systems, Inc. All rights reserved. 10849_Icons_May2005 Cisco Public

Spanning Tree Basics

41© 2005 Cisco Systems, Inc. All rights reserved. 10849_Icons_May2005 Cisco Public

Spanning Tree Attack

42© 2005 Cisco Systems, Inc. All rights reserved. 10849_Icons_May2005 Cisco Public

Spanning Tree Attack

43© 2005 Cisco Systems, Inc. All rights reserved. 10849_Icons_May2005 Cisco Public

Contramedidas: BPDU Guard

44© 2005 Cisco Systems, Inc. All rights reserved. 10849_Icons_May2005 Cisco Public

Contramedidas: Root Guard

45© 2005 Cisco Systems, Inc. All rights reserved. 10849_Icons_May2005 Cisco Public

CDP Attack

46© 2005 Cisco Systems, Inc. All rights reserved. 10849_Icons_May2005 Cisco Public

CDP Attack

47© 2005 Cisco Systems, Inc. All rights reserved. 10849_Icons_May2005 Cisco Public

MATRIZ DE EQUIPOS

48© 2005 Cisco Systems, Inc. All rights reserved. 10849_Icons_May2005 Cisco Public

Más Contramedidas

49© 2005 Cisco Systems, Inc. All rights reserved. 10849_Icons_May2005 Cisco Public

Storm Control

50© 2005 Cisco Systems, Inc. All rights reserved. 10849_Icons_May2005 Cisco Public

Rate Limiting

51© 2005 Cisco Systems, Inc. All rights reserved. 10849_Icons_May2005 Cisco Public

Priority Policing

52© 2005 Cisco Systems, Inc. All rights reserved. 10849_Icons_May2005 Cisco Public

Secure Shell

53© 2005 Cisco Systems, Inc. All rights reserved. 10849_Icons_May2005 Cisco Public

Configuration File Security

54© 2005 Cisco Systems, Inc. All rights reserved. 10849_Icons_May2005 Cisco Public

Power Over Ethernet Attacks

55© 2005 Cisco Systems, Inc. All rights reserved. 10849_Icons_May2005 Cisco Public

PoE Attacks

56© 2005 Cisco Systems, Inc. All rights reserved. 10849_Icons_May2005 Cisco Public

PoE Attacks: Contramedidas

57© 2005 Cisco Systems, Inc. All rights reserved. 10849_Icons_May2005 Cisco Public

PoE Attacks: Contramedidas

58© 2005 Cisco Systems, Inc. All rights reserved. 10849_Icons_May2005 Cisco Public

VLAN HOPPING ATTACK

59© 2005 Cisco Systems, Inc. All rights reserved. 10849_Icons_May2005 Cisco Public

VLAN HOPPING

60© 2005 Cisco Systems, Inc. All rights reserved. 10849_Icons_May2005 Cisco Public

VLAN HOPPING: CONTRAMEDIDAS

61© 2005 Cisco Systems, Inc. All rights reserved. 10849_Icons_May2005 Cisco Public

USANDO SU CATALYST PARA PROTEGERSE: ACLs

62© 2005 Cisco Systems, Inc. All rights reserved. 10849_Icons_May2005 Cisco Public

TIPOS DE ACCESS LISTS

63© 2005 Cisco Systems, Inc. All rights reserved. 10849_Icons_May2005 Cisco Public

TIPOS DE ACCESS LISTS

64© 2005 Cisco Systems, Inc. All rights reserved. 10849_Icons_May2005 Cisco Public

CONFIGURING VACLs

65© 2005 Cisco Systems, Inc. All rights reserved. 10849_Icons_May2005 Cisco Public

CONFIGURING VACLs

66© 2005 Cisco Systems, Inc. All rights reserved. 10849_Icons_May2005 Cisco Public

CONFIGURING VACLs

67© 2005 Cisco Systems, Inc. All rights reserved. 10849_Icons_May2005 Cisco Public

CONFIGURING VACLs

68© 2005 Cisco Systems, Inc. All rights reserved. 10849_Icons_May2005 Cisco Public

CONFIGURING VACLs

69© 2005 Cisco Systems, Inc. All rights reserved. 10849_Icons_May2005 Cisco Public

CONFIGURING VACLs

70© 2005 Cisco Systems, Inc. All rights reserved. 10849_Icons_May2005 Cisco Public

Monitoring VACLs – Capture Port

71© 2005 Cisco Systems, Inc. All rights reserved. 10849_Icons_May2005 Cisco Public

Monitoring VACLs – Capture Port

72© 2005 Cisco Systems, Inc. All rights reserved. 10849_Icons_May2005 Cisco Public

Monitoring VACLs – Capture Port