Configuration Detail Switch Access

Configuration detail switch access (cisco) 1. Secure MAC, strike MAC spoofing Att description XXX switchport mode access spanning-tree portfast switchport port-security switchport port-security violation restrict switchport port-security mac-address sticky 2. Spanning-tree 2.1 Portfast Enable default portfast for all access port spanning-tree portfast enable 2.2 Rapid STP spanning-tree mode rapid-pvst 3. Protecting the network from spoofing att(DHCP, ARP) 3.1 Secure DHCP source (global) ip dhcp snooping (global) ip dhcp snooping infomation option (interface) ip dhcp snooping trust (global) ip dhcp snooping vlan vlan_id 3.2 Dynamic ARP Inspection (global) ip arp inspection vlan vlan_id (interface) ip arp inspection trust if the interface is not trusted then validate (interface) ip arp inspection validate 4. Access restriction using ACL line con 0 exec-timeout 6 0 password 7 15315A1F077A login transport input none line 1 8 speed 115200 line aux 0 line vty 0 4 access-class 90 in password 7 0817627E3D4A35362B login transport input telnet, or SSH.

5. Turn off CDP if possible 6. Secure STP 7. Double check trunk link 8. Using secure access client such as SSHv2 9. Using syslog 10. Avoid using VLAN1 for management purposes