Network Security
This chapter covers infrastructure and access security, including Layer 2 protections, 802.1X authentication, AAA with RADIUS and TACACS+, and secure device management. Security is woven through every layer of an enterprise network.
Layer 2 protection
Switch features defend the access edge: DHCP snooping trusts only designated ports for DHCP server responses and blocks rogue DHCP servers, building a binding table that Dynamic ARP Inspection uses. Port security limits which and how many MAC addresses appear on a port, and BPDU guard protects the spanning-tree edge from unexpected switches.
802.1X and AAA
802.1X port-based authentication involves a supplicant (client), an authenticator (the switch or WLC that controls the port), and an authentication server (usually RADIUS) that decides accept or reject. TACACS+ is favored for device administration with per-command authorization and full-payload encryption, while RADIUS is common for network access authentication of endpoints.
Secure device management
Management access should use encrypted protocols: SSH instead of Telnet, and SNMPv3 instead of the weaker SNMPv1 and v2c. Moving an insecure protocol to a nonstandard port does not make it secure. Choosing encrypted management channels protects credentials and configuration from eavesdropping.