Security Fundamentals
Security fundamentals introduce the threats networks face and the controls that mitigate them. This domain covers access control lists, Layer 2 protections like port security and DHCP snooping, and secure access with AAA. It also addresses wireless security standards and device hardening practices.
Security Concepts and AAA
Core security goals are confidentiality, integrity, and availability, defended against threats, vulnerabilities, and exploits. AAA provides Authentication (who you are), Authorization (what you may do), and Accounting (what you did), often via RADIUS or TACACS+ servers. Centralizing AAA improves control over administrative and user access. Strong password policies and role separation reduce risk.
Access Control Lists
ACLs filter traffic by permitting or denying packets against a top-down list of statements ending in an implicit deny. Standard ACLs match only the source IP and are placed near the destination, while extended ACLs match source, destination, protocol, and port and are placed near the source. Wildcard masks define which address bits to check. ACLs also classify traffic for other features.
Layer 2 Security
Port security limits which MAC addresses may use a switch port and can shut down the port on a violation, the default action. DHCP snooping distinguishes trusted from untrusted ports and drops rogue DHCP server replies on untrusted ports. Dynamic ARP Inspection uses the snooping binding table to block ARP spoofing. These features protect the access layer from common attacks.
Wireless Security
Wireless links are inherently exposed, so encryption and authentication are essential. WEP and the original WPA are broken and deprecated, while WPA2 uses AES-CCMP and remains widely deployed. WPA3 strengthens security with SAE, which resists offline dictionary attacks, and adds forward secrecy. Enterprise modes add 802.1X authentication against a RADIUS server.
Device Hardening and Secure Access
Devices should be managed over SSH rather than clear-text Telnet to protect credentials and commands in transit. Disabling unused services, applying login banners, and enforcing enable secrets reduce the attack surface. Access to VTY lines can be restricted with ACLs and AAA. Regular patching and configuration backups round out sound hardening practices.