Five Minutes and an Empty Port Part 7: Port Security and the Layer 2 Hygiene Most Networks Already Own

Every tool in Parts 2 through 6 depended on one shared assumption: that a switch port would forward traffic for whatever got plugged into it, no questions asked. That assumption is the actual target of this part, and unlike a lot of security advice, closing it off doesn’t need new hardware. Most enterprise switches from Cisco, Fortinet, Juniper, and Arista have shipped port security and the rest of this feature set for well over a decade. The gap is almost always that it’s never turned on, not that it’s unavailable.

Port security: limiting what a port will even talk to

Port security works on the simplest possible idea: a switch port learns the MAC address of whatever’s connected to it, and once it’s learned one, or a small configured number, it refuses to forward traffic for anything else. Plug a Shark Jack into a port that already has a phone or a workstation attached, and the port either silently drops the new device’s frames or shuts itself down entirely, depending on the configured violation action.

On Cisco IOS-XE, the baseline looks like this:

interface GigabitEthernet1/0/12
 switchport mode access
 switchport port-security
 switchport port-security maximum 2
 switchport port-security mac-address sticky
 switchport port-security violation restrict

sticky learns the first MAC addresses seen and locks them in without an administrator having to hand-enter them, maximum 2 allows for a phone-plus-PC daisy chain, and violation restrict drops unauthorized traffic and logs it rather than shutting the port, which is usually the better default for a port a help desk doesn’t want to keep manually re-enabling.

FortiSwitch, managed through a FortiGate via FortiLink, does the same job under config switch-controller security-policy 802-1X and per-port config switch-controller managed-switch, with mac-limit capping learned addresses per port. Juniper Junos EX calls the same concept port-security under [ethernet-switching-options secure-access-port], with mac-limit and interface-mac-limit doing the equivalent job to Cisco’s maximum.

The rest of the First Hop Security suite

Port security only answers “how many devices, and are they the ones I already trust.” A cluster of related controls, generally grouped under the name First Hop Security, answers the questions right next to it.

DHCP snooping classifies ports as trusted (uplinks toward the real DHCP server) or untrusted (everything else), and drops DHCP server responses, offers, acks, from any untrusted port. This is the direct answer to a rogue DHCP server, and it also builds a binding table, a live record of which MAC address holds which leased IP on which port, that the next two controls both depend on.

Dynamic ARP Inspection checks every ARP packet on an untrusted port against that DHCP snooping binding table, and drops anything that doesn’t match. This is what stops ARP spoofing/poisoning outright, since a device can no longer claim to own an IP address it was never actually leased.

IP Source Guard does the equivalent check on the IP layer itself: a port can only send traffic from the source IP address the binding table says it actually holds, closing off basic IP spoofing from an untrusted port.

Cisco IOS-XE turns all three on together fairly compactly:

ip dhcp snooping
ip dhcp snooping vlan 10
!
interface GigabitEthernet1/0/12
 ip verify source
 ip dhcp snooping limit rate 15
!
interface GigabitEthernet1/0/1
 ip dhcp snooping trust

ip verify source is IP Source Guard; Dynamic ARP Inspection is enabled per-VLAN with ip arp inspection vlan 10, applying automatically to any port not explicitly marked trusted.

Unused ports and the native VLAN

Two habits do a disproportionate amount of good relative to how little effort they take. First: every port not actively in use should be administratively shut down and dropped into an unused, non-routed VLAN, so a Shark Jack finding an “empty” port finds one that goes nowhere. Second: the native VLAN on every trunk should be changed off VLAN 1 and left otherwise unused, closing off VLAN hopping attacks that rely on double-tagged frames riding the default native VLAN across a trunk boundary.

What this section doesn’t cover yet

Port security and DHCP snooping answer “is this the device I already know about.” They don’t answer “should this specific person, on this specific device, be allowed on this network at all,” which is a harder, identity-based question. That’s Part 8’s subject: 802.1X and the NAC platforms, Cisco ISE, FortiNAC, Aruba ClearPass, that sit behind it.