Switch Port Hardening: The Layer 2 Controls, in One Checklist

Layer 2 attacks are almost all defeated by configuration that takes minutes and is almost never applied. This is the consolidated list — each control, the specific attack it stops, and where it belongs. Treat it as the access switch template.

Port security

Limits how many MAC addresses a port may learn. An access port serving one workstation needs one, or two where an IP phone passes traffic through.

Stops: MAC flooding, which fills the switch's address table so it fails open and floods frames to every port, turning a switch into a hub — the attack under MAC flooding. Also constrains casual MAC spoofing and unauthorized devices.

Configure: a low maximum, sticky learning so the address is recorded automatically, and a violation action of shutdown with timed error-disable recovery.

PortFast with BPDU Guard

PortFast skips the spanning tree listening and learning states so a host gets a working link immediately. BPDU Guard shuts the port down if any bridge protocol data unit arrives, which an end host should never send.

Stops: a switch or consumer router plugged into a user port from forming a loop or hijacking the spanning tree topology. Together they are the standard access port pairing, and PortFast without BPDU Guard is actively dangerous — the detail under BPDU Guard, Root Guard and Loop Guard.

Root Guard and Loop Guard

Root Guard on ports facing switches you do not control blocks any port advertising a superior bridge ID, so no downstream device can become the root bridge and redirect traffic through itself.

Loop Guard on inter-switch links prevents a blocking port transitioning to forwarding when expected BPDUs stop arriving due to a unidirectional link failure.

DHCP snooping

Marks ports as trusted or untrusted and drops DHCP server responses arriving on untrusted ports.

Stops: a rogue DHCP server handing out its own address as the default gateway or DNS server — a machine-in-the-middle position obtained with no exploitation, and the mechanism behind the router-level redirection described under pharming.

Also provides: the binding table of address-to-MAC-to-port assignments, which the next control depends on. This is why the two are always deployed together.

Dynamic ARP Inspection

Validates ARP packets on untrusted ports against the DHCP snooping binding table and drops anything that does not match.

Stops: ARP cache poisoning, which is the standard same-segment interception technique — covered under ARP spoofing. Statically addressed devices need manual bindings, which is the small piece of ongoing work this control costs.

Trunk and VLAN hygiene

Disable dynamic trunk negotiation and set every port explicitly as access or trunk. Change the native VLAN on trunks to an unused VLAN carrying no user traffic, or tag it. Prune each trunk to the VLANs it actually needs. Do not use VLAN 1 for anything.

Stops: switch spoofing, where a device negotiates a trunk and receives every VLAN, and double tagging, which exploits untagged native VLAN traffic — both described under 802.1Q VLAN tagging.

Storm control and unused ports

Storm control rate-limits broadcast, multicast and unknown unicast traffic, shutting the port or dropping excess beyond a threshold — a safety net against a broadcast storm from a loop or a malfunctioning device.

Administratively shut down every unused port and assign it to an unused VLAN, so a cable plugged into an empty jack reaches nothing. This is the cheapest control on the list and the one most often skipped in offices with more jacks than people.

802.1X on top

Everything above constrains what a connected device can do. 802.1X decides whether it connects at all, authenticating the device or user before the port carries traffic and assigning a VLAN based on identity.

It is the strongest of these controls and the most work to deploy, and it does not replace the others — an authenticated device can still poison ARP, and a printer on MAC authentication bypass is trivially spoofed.

Monitoring

Every control here generates events when it fires, and those events are security signals rather than networking noise. Port security violations, BPDU Guard shutdowns, DHCP snooping drops and DAI rejections should all reach your SIEM. A port disabling itself means something was plugged in that should not have been, and nobody hears about it if the logs stay on the switch.

Exam angles

Match each control to its attack: port security to MAC flooding, BPDU Guard to rogue switches and loops, Root Guard to spanning tree hijacking, DHCP snooping to rogue DHCP servers, Dynamic ARP Inspection to ARP poisoning, disabled dynamic trunking and a changed native VLAN to VLAN hopping, and storm control to broadcast storms. Know that DAI depends on the DHCP snooping binding table, and that 802.1X authenticates before any of the others apply.