Protecting Against Switch Spoofing

• Manually configure access ports: Manually configuring access ports prevents trunks from being dynamic.
• Shut down unused interfaces: This is a best practice regardless of security configuration around switch spoofing, and it aids in preventing connection of wrong ports, incorrect cabling, and so on.
• Restrict VLANs on trunk ports: Reducing the number of VLANs to only interested VLANs helps limit the impact of switch spoofing.

Protecting Against VLAN Hopping

• Configure the native VLAN of all trunk ports to an unused VLAN.
• Prune the native VLAN from the trunk.
• Tag all frames on trunk ports by default.

Note, native VLAN pruning will not affect the functionality of maintenance protocols, such as CDP and DTP, because they will use the native VLAN regardless of configuration.

VLAN Access Lists

VACLs can provide access control for all packets that are bridged within a VLAN or packets that are routed into or out of a VLAN or a WAN interface. Unlike Cisco IOS ACLs that are applied on routed packets only, VACLs apply to all packets and can be applied to any VLAN or WAN interface.

Types of configurations

• IP access list: Filters IPv4 and IPv6 packets on a Layer 2 port.
• MAC access list: Filters packets that are of an unsupported type (not IP!) based on the fields of the Ethernet datagram. A MAC access list is not applied to IP messages.

More Understanding

• Understanding VLAN ACLs

References

• Understanding & Configuring VLAN ACLs
• VLAN Access-List (VACL)