Skip to content

🛡ī¸ Cisco IOS Layer 2 Security Configuration Guide

This guide outlines key Layer 2 security features for Cisco switches running IOS. These features help protect against spoofing, flooding, unauthorized access, and misconfigurations at the access layer.

🔐 1. Port Security

Restricts access to switch ports based on MAC addresses.

Configuration

interface FastEthernet0/1
switchport mode access
switchport port-security
switchport port-security maximum 1
switchport port-security mac-address sticky
switchport port-security violation restrict

Violation Modes

  • protect: drops unauthorized frames silently
  • restrict: drops and logs violations
  • shutdown: disables the port (default)

Show Commands

show port-security
show port-security interface FastEthernet0/1

📡 2. DHCP Snooping

Prevents rogue DHCP servers from assigning IP addresses.

Enable Globally

ip dhcp snooping
ip dhcp snooping vlan 10

Configure Trusted Ports

interface FastEthernet0/24
ip dhcp snooping trust

Limit Rate

interface FastEthernet0/1
ip dhcp snooping limit rate 10

Show Commands

show ip dhcp snooping
show ip dhcp snooping binding

đŸ•ĩī¸ 3. Dynamic ARP Inspection (DAI)

Validates ARP packets against DHCP snooping bindings to prevent spoofing.

Enable Globally

ip arp inspection vlan 10

Configure Trusted Ports

interface FastEthernet0/24
ip arp inspection trust

Show Commands

show ip arp inspection
show ip arp inspection statistics

đŸ§¯ 4. BPDU Guard

Protects against rogue switches by disabling ports that receive BPDUs.

Enable on Access Ports

interface FastEthernet0/1
spanning-tree bpduguard enable

Enable Globally (for PortFast ports)

spanning-tree portfast bpduguard default

Show Commands

show spanning-tree interface FastEthernet0/1 detail

🌩ī¸ 5. Storm Control

Limits broadcast, multicast, or unicast traffic to prevent flooding.

Configure Broadcast Storm Control

interface FastEthernet0/1
storm-control broadcast level 10.00

Show Commands

show storm-control

✅ Best Practices

  • Use sticky MACs for persistent port security
  • Trust only uplink ports for DHCP and ARP
  • Enable BPDU Guard on all edge ports
  • Monitor violation counters regularly
  • Document VLANs, bindings, and trusted ports