layer 2 hardening, diagram then config

why layer 2 is the part everyone forgets

everyone locks down firewalls, patches servers, sets up mfa, and then plugs a switch into the wall and never thinks about it again. but layer 2 is the foundation everything else sits on. if someone can flood your switch, hand out fake dhcp leases, or spoof arp replies, it doesn't matter how good your layer 3 and up security is. they're already inside the room you thought you locked.

the good news is layer 2 hardening is not complicated. it's three features that work together, and once you understand the diagram in your head the config basically writes itself.

port security, stopping mac flooding

a switch builds a table mapping mac addresses to ports so it knows where to send traffic. an attacker can flood that table with thousands of fake mac addresses until it fills up. once it's full, the switch can't learn new legit entries and starts broadcasting everything out every port like a dumb hub. that means the attacker suddenly sees traffic that was never meant for them.

port security fixes this by limiting how many mac addresses are allowed on a single access port, usually one or two for a normal user PC. if a device tries to exceed that limit, the port shuts down or drops the offending traffic depending on the violation mode you pick.

switchport port-security
switchport port-security maximum 2
switchport port-security violation restrict
switchport port-security mac-address sticky

the sticky keyword tells the switch to learn the first mac addresses it sees and lock them in, so you're not manually typing addresses for every jack in the building.

dhcp snooping, trusting only the real server

dhcp has no built in authentication. any device on the network can pretend to be a dhcp server and start handing out ip addresses, fake gateways, fake dns servers, whatever it wants. that's a classic setup for a man in the middle attack, and it's trivially easy to pull off with free tools.

dhcp snooping fixes this by having the switch track which port your real dhcp server is on and marking that port as trusted. every other port is untrusted, meaning the switch will simply drop dhcp server responses coming from anywhere else.

ip dhcp snooping
ip dhcp snooping vlan 10
interface gi0/1
 ip dhcp snooping trust

only the uplink toward your actual dhcp server gets the trust command. everything else stays untrusted by default, which is exactly what you want.

dynamic arp inspection, stopping spoofing

arp is another protocol built with zero verification. a device can just claim "i am 192.168.1.1" and other hosts will believe it, sending their traffic straight to the attacker instead of the real gateway. this is arp spoofing, and it's one of the most common ways attackers intercept traffic on a local network.

dynamic arp inspection, or dai, leans on the dhcp snooping table the switch already built. it knows which ip address is legitimately tied to which mac and port, so it can check every arp packet against that table and drop anything that doesn't match.

ip arp inspection vlan 10
interface gi0/1
 ip arp inspection trust

again, only trust the uplink to your legit infrastructure. every access port stays untrusted and gets checked.

how it plays out

picture the diagram. a normal user pc plugs into an access port, gets one dhcp lease from the trusted uplink, and its arp traffic checks out against the snooping table. everything just works, no different from before.

now picture a rogue device on that same access port trying to flood macs, hand out fake dhcp leases, or spoof arp. port security shuts the flood down, dhcp snooping ignores the fake server, and dai drops the spoofed arp packets. the rogue gets silently shut out while the legit user never notices a thing.

the takeaway

layer 2 attacks work because switches were designed to be helpful and fast, not suspicious. port security, dhcp snooping, and dynamic arp inspection add the suspicion back in without breaking anything for legitimate devices. if you're running a network at home, in a lab, or for a small business, go check your switch config right now. if these three features aren't on, that's your exposure. turn them on, test with a normal device first, and confirm nothing breaks before you walk away. that's the whole job.