CND (312-38) Network Defense Simulation
Investigate an unauthorized device connecting to the enterprise network. Learn how to configure and analyze access layer controls to prevent rogue endpoints using hardware address restrictions.
Network Scenario
You are a Network Security Analyst monitoring the access layer of your organization. A user in the HR department calls the helpdesk to report that their network connection dropped suddenly. The user admits they unplugged their corporate desktop to briefly plug in their personal laptop.
You review the syslog server for events originating from the access switch serving the HR floor to verify the port status and understand the automated defensive response.
Traffic & Logs
Excerpt from Access Switch Syslog:
Question
You want to increase your network security implementing a technology that only allows certain MAC addresses in specific ports in the switches; which one of the above is the best choice?
Expert Analysis
1. What is happening in the network
An employee disconnected their trusted, corporate-issued workstation (causing the interface to briefly go `down`) and connected an unauthorized personal laptop (interface comes back `up`). The switch immediately detected a new MAC address (`001a.bc22.3344`) that was not permitted on that interface, triggering an automated shutdown (`err-disable` state).
2. Identify attack or behavior
This is a Rogue Device Connection. While not necessarily malicious in this scenario, plugging an unmanaged device into an enterprise network bypasses corporate security controls (antivirus, patches) and creates a severe risk of malware propagation or unauthorized data exfiltration.
3. Why the correct answer is correct
A. Port Security: This is the exact feature used on enterprise switches to limit the number of allowed MAC addresses per port and to define specifically which MAC addresses are authorized. If an unauthorized MAC address is detected, the port security feature can be configured to restrict traffic, log the event, or completely shut down the port (as seen in the logs).
4. Why others are wrong
- B. Port Authorization: While 802.1X is a standard for port-based Network Access Control (NAC) that "authorizes" a port, the standard terminology for MAC-based restriction on basic switches is Port Security.
- C. Port Detection: This is a distractor term. In network security, this terminology does not refer to a standard technology or control.
- D. Port Knocking: This is a firewall security technique where a specific sequence of connection attempts to closed ports temporarily opens a target port (usually for SSH or administrative access). It has nothing to do with Layer 2 MAC addresses or physical switch ports.
5. Defensive action
To properly manage this security event, a defender should:
- Confirm the user's identity and intent. Instruct them to reconnect the approved corporate device.
- Clear the `err-disable` state manually via the switch CLI (`shutdown` followed by `no shutdown` on the interface) to restore connectivity for the authorized machine.
- For defense-in-depth, consider migrating from static Port Security to dynamic 802.1X, which requires cryptographic user or machine authentication rather than easily spoofed MAC addresses.
6. MINI LESSON: Layer 2 Defenses
Defense-in-Depth at the Access Layer: MAC addresses are easily spoofed, meaning Port Security is a foundational, but not foolproof, defense. It is primarily useful for preventing CAM table overflow attacks, stopping non-malicious users from plugging in unapproved hubs/switches, and establishing basic environmental control. For true identity-based access, networks must utilize IEEE 802.1X.