Cisco Catalyst 6880-X Specifications download pdf (Page 78)

Distribution Layer April 2014

If the interface type is not portchannel, then the additional command macro apply EgressQoS must also be

configured on the interface.

Next, mitigate VLAN hopping on the trunk for switch-to-switch connections.

There is a remote possibility that an attacker can create a double 802.1Q encapsulated packet. If the attacker has

specific knowledge of the 802.1Q native VLAN, they could create a packet that when processed, removes the

first or outermost tag when the packet is switched onto the untagged native VLAN. When the packet reaches the

target switch, the inner or second tag is then processed and the potentially malicious packet is switched to the

target VLAN.

At first glance, this appears to be a serious risk. However, the traffic in this attack scenario is in a single direction

and no return traffic can be switched by this mechanism. Additionally, this attack cannot work unless the attacker

knows the native VLAN ID.

Step 5: Configuring an unused VLAN on all switch-to-switch 802.1Q trunk links from access layer to distribution

layer removes the remote risk of this type of attack. By choosing an arbitrary, non-default, unused VLAN

assignment for the native VLAN, you reduce the possibility that a double 802.1Q-tagged packet can hop VLANs.

vlan 999

name AntiVLANhopping

exit

interface [port-channel] [number]

switchport trunk native vlan 999

Step 6: Configure Layer 3.

Configure a VLAN interface (SVI) for every access layer VLAN so devices in the VLAN can communicate with the

rest of the network.

Use the ip helper-address command to allow remote DHCP servers to provide IP addresses for this network.

The address that the helper command points to is the central DHCP server. If you have more than one DHCP

server, you can list multiple helper commands on an interface.

interface vlan [number]

ip address [ip address] [mask]

ip helper-address [dhcp server ip]

ip pim sparse-mode

no shutdown

1 2 ... 73 74 75 76 77 78 79 80 81 82 83 ... 110 111

No comments

Cisco Catalyst 6880-X Specifications Page 78