CCIE Security Layer 2 Security Deep Dive: Labs

Explore how switching uses MAC addresses to learn and forward frames, build a CAM table, and handle ARP requests and broadcasts in layer 2 networks.

Learn how layer 2 switching forwards frames by destination MAC and builds CAM table through source MAC learning. It uses ARP to resolve destination MAC and floods broadcasts when needed.

Explore similarities and dissimilarities between layer 3 routing and switching, both forwarding packets based on destination IP addresses, with routing using gateways and layer 3 switching using dedicated hardware.

Explain layer 4 switching, which inspects DCP and UDP port numbers, checks segments and checksums, and forwards transport-layer traffic on switches, bridging layer 2 frames and layer 3 packets.

Learn how switches learn MAC addresses of end devices through IP-addressed and non-ip scenarios, using ARP requests and broadcasts to populate the MAC address table.

Learn how layer 2 switch tables use content addressable memory to map MAC addresses to exit interfaces, and how security ACLs and QoS relate to switch behavior.

Explore MLS and how switches forward frames by destination MAC addresses at layer 2 and packets by destination IP addresses at layer 3, with UDP port verification.

Explore first generation multi-layer switching, where the route processor analyzes packets, creates destination entries, and the switch engine forwards traffic based on those entries to the correct interface.

Explains second-generation multi-layer switching where a forwarding information base (fib) is distributed across six application-specific integrated circuits, enabling hardware-based packet forwarding with network ID and next-hop information.

Explore how MLS switch tables learn MAC addresses with content-addressable memory, and how feature manager and switching database manager compile and store ACLs for security and QoS.

Explore the forwarding information base (FIB) and its components, including the routing table, next-hop data, and network IDs, to understand how multi-layer information is maintained.

Explore how the packet rewriter operates within a multilayer switch, rewriting source and destination information, updating next hop, MAC address, and exit interface, while applying ACLs and checksums.

Learn to configure switch ports as access ports or trunks, including setting trunk encapsulation dot1q, applying access mode, and verifying configurations with show commands across multiple switches.

Learn how to use the interface range command on Cisco switches to configure multiple ports at once, including setting access modes and trunks, and verify with show commands.

Learn to create and apply macro commands on Cisco switches, define interface ranges, assign macro names, and apply consistent configurations across multiple ports.

Configure descriptions on switch interfaces to label connected devices, using default interface ranges, assign per-port descriptions for pcs, servers, gateways, and other devices, and verify connections across switches.

Learn how to configure switch port speed on Cisco switches, selecting 100 Mbps or 1 Gbps on fast ethernet and gigabit interfaces. Verify settings with show commands.

Learn how to configure switch port duplex on an interface, choosing half or full duplex and applying forced duplex when needed, with defaults and basic verification.

Configure Cisco error-disable commands to manage port states by selecting detect causes, setting recovery conditions, and timing, then verify outcomes with history and related guard commands.

Learn how the Cisco discovery protocol works on routers and switches, and view connected devices with show CDP neighbor, noting it is enabled by default.

Enable LLDP on Cisco switches, recognize it as an open standard available on any vendor device, and use show commands to view neighbors and port mappings.

Learn how switching uses destination MAC addresses to forward frames, learn MAC tables, and apply filtering for loop avoidance, including flooding, broadcast, multicast, and spanning tree concepts.

Compare store-and-forward, cut-through, and fragment-free switching methods, detailing error detection, destination MAC-based forwarding, and how frames are learned and dropped when needed.

This lecture explains unicast, broadcast, and multicast MAC addresses, showing unicast targets a single device while switches flood broadcast and multicast frames to all ports except the origin.

Define the broadcast domain as the set of LAN-connected devices where a broadcast frame reaches all devices. Switches flood frames to all ports, creating a single broadcast domain.

A collision domain is the set of LAN-connected devices sharing a single channel. When a device transmits a frame, others hear it and collisions may occur, especially with hubs.

Explain csma/cd, a media access control method used by local area networks in early internet technology, that listens before transmitting, detects collisions, and uses backoff to manage access.

Explore static vlan introduction and how switch port configurations assign devices to predefined vlan memberships based on port numbers, contrasting with dynamic vlan concepts.

Introduce dynamic VLANs that assign devices to VLANs by MAC address, detailing MAC learning, VMP checks, and VLAN assignment to 100 or 200, with 802.1x and radius evolution.

Explore vlan tagging introduction by showing how switches add an extra header with a frame id and forward frames across switches, tagging the vlan id for each frame.

Explore the Cisco proprietary ISL encapsulation, including its 26-byte header and 4-byte trailer, and how dirty tagging and double tagging prepare frames on Cisco devices.

Explore 802.1q, an open trunking protocol that uses smart tagging to insert a 4-byte tag into frames without encapsulating the header or trailer, carrying protocol identifier and quality of service.

Configure inter-VLAN routing using router on a stick, creating VLANs 20, 30, 40, 50, and 60, setting trunk links, dot1q encapsulation, and router interfaces with IPs to enable inter-switch communication.

Set up inter-vlan routing via SVI by configuring VLANs 10, 20, 30, 40, 50, 60, creating interfaces and IPs, and designating gateways on a switch in this hands-on lab.

Configure a dynamic VLAN lab using MD5 with Cisco ISE, setting up RADIUS authentication, policies, groups, and VLAN assignment to automate access control.

Learn to configure dynamic VLAN with MD5 verification, assign VLAN 50 to interface 48, and verify authentication on a test pc through successful login and saved configurations.

Configure dynamic VLAN assignment using PEAP with Cisco Identity Services Engine, integrating a Radius server for 802.1X wired access. Create identity groups, policies, and authorization profiles to enforce access.

Explore a dynamic VLAN lab with PEAP verification, validating wireless client authentication, session tracking, and IP assignment via RADIUS and device tracking on a switch and access point.

Explore vtp as a layer 2 messaging system that propagates vlan creation and deletion. Learn vtp modes, including server and transparent, and how they simplify vlan management.

Explore how the VTP server mode, the default DP mode, creates and deletes wheelings, forwards updates to other switches, accepts updates, and stores information in flash memory.

Discover VTP client mode in CCIE security labs: it cannot create or delete VLANs, accepts updates from the VTP server, and stores VLAN info in flash memory while forwarding updates.

Explore how VTP transparent mode differs from server mode by allowing local VLAN creation and deletion while not updating or accepting VTP updates, and still forwarding advertisements.

Delve into the default VTP configuration, covering null domain name, null VTP password, VTP mode defaults, VTP versions 1–3, and VTP pruning, as the basis for later configuration decisions.

Learn how VTP updates propagate between switches, with domain name and password rules, and how a switch’s configuration revision number determines if an update is accepted.

Explore VTP working requirements and versions, including domain name and password matching, trunk port connectivity, and VTP versions 1, 2, and 3 with default settings.

Explore VTP messages used in layer 2 security labs, detailing advertisement and subset advertisement flows, domain name, password and configuration data, sequence numbers, and client/server requests.

Learn how VTP pruning reduces network broadcasts by ensuring switches forward broadcasts only to segments with active users, with steps to enable pruning across all switches.

Explore dynamic trunking protocol (DTP) and trunk negotiation on Cisco switches, including dynamic desirable and dynamic auto, and manual configuration for cross-cable links when peers are not DTP enabled.

Explore native vlan behavior in 802.1Q encapsulation, where untagged frames are forwarded as native traffic on vlan 1 by default, with switches flooding and forwarding frames without tags.

Explore how to configure a VTP lab in a multi-switch topology, including server and client roles, domain name setup, password configuration, pruning, and handling DP updates and relays.

Learn the spanning tree protocol, which prevents frame loops by placing interfaces in forwarding or blocking states and avoids broadcast storms, MAC table instability, and address learning issues.

Discover STP tasks and the root bridge election, showing how bridge ID combines priority and MAC to select the root. Identify designated and root ports and how BPDU cost guides DP elections.

Explore the basics of STP BPDU types, how switches exchange hello messages, and how root and non-root bridges handle configuration BPDUs and topology change notifications.

Explore how STP cost, an implicit value predefined by IEEE, guides designated port roles and root bridge election, and review the default costs and how to adjust them.

the lecture explains stp root bridge election using the lowest default priority and, when tied, the lowest mac address, with bridge id formed from priority and mac.

Examine the STP root bridge election process by watching switches exchange BPDUs, compare bridge priorities, and use MAC addresses to break ties and elect the root.

Learn how spanning tree protocol selects the root bridge and designates ports using cost and priority, establishing root ports and designated ports to prevent loops.

Explore the spanning tree protocol timers—hello time 2 seconds, max age 20 seconds, and forward delay 15 seconds—and their role in listening and learning states.

Explore the STP port states: disabled, blocking, listening, learning, and forwarding, and how each state governs administrative shutdown, bpdu handling, and mac address learning.

Explore STP topology changes by examining direct, indirect, and insignificant changes when links go down. Understand how these events affect bridge roles and topology in a CCIE security lab setting.

Explain STP port states and convergence, from blocking to listening, learning, and forwarding. Introduce PortFast, which moves ports to forwarding on activation.

Learn how spanning tree uplink fast enables non-root switches to move to forwarding when the root goes down, reducing convergence time to about 50 seconds.

Explore STP backbone fast introduction, how root port transitions and blocking ports safeguard the network, and how backbone fast prevents inferior BPDU and speeds recovery through listening and learning states.

Explore a spanning tree protocol lab to identify the root by MAC address and priority, and determine root ports, designated ports, and blocking links.

Understand how STP Portfast speeds convergence by placing ports into forwarding immediately when they become physically active, skipping listening and learning states, and enable Portfast on all access ports.

Learn to configure the spanning tree protocol portfast in a multi-switch topology, enabling fast transitions from blocking to forwarding and validating trunk interfaces and switch connectivity.

explains spanning tree convergence and the uplinkfast feature, showing how non-root switches quickly place an alternate port into forwarding when the root bridge fails to reduce downtime.

Explore stp uplinkfast behavior in a three-switch topology, configure root priority to designate the root, and verify rapid convergence as ports transition through listening, learning, and forwarding states.

Explore STP backbone fast and its role in preventing inferior BPDU, enabling switches to query neighbors when a root port fails, speeding convergence from blocking to forwarding.

Explore how STP backbone fast prevents inferior BPDU in spanning-tree topologies by enabling backbone fast on switches and testing with interface shutdown to observe immediate root-port decisions.

Explore stp root guard introduction, see how the guard feature blocks bpdu changes to the root, ensures consistent states, and prevents root instability across switch ports.

Demonstrate STP root guard lab across switches, configure root guard on ports, observe blocking and unblocking in response to BPDU, and restore normal operation for a stable topology.

Learn how STP loop guard prevents loops by keeping a port silent when BPDU updates stop arriving, moving to a loop-inconsistent state, and resuming normal forwarding when BPDUs return.

Enable loop guard on switch ports to protect spanning tree; ports not receiving bpdu enter a loop inconsistent state, while ports that receive bpdu remain silent.

Explore how attackers exploit BPDU with zero priority to become root, and how STP BPDU guard prevents this by placing offending ports in an error-disabled state.

Enable BPDU guard on interfaces or globally, then verify that receiving BPDU places the port in an err-disabled state, demonstrating protection in the STP lab.

Explore stp bpdu guard and bpdu filter concepts, showing how they block or guard against bpdu traffic on access and server-connected ports to protect the network.

Perform a hands-on STP BPDU filter lab to block BPDUs, learn global and interface-level enablement, and observe how filtering affects spanning-tree port states on switches.

Explore UDLD unidirectional link detection for fiber connections, showing how two switches exchange messages to verify bidirectional links and trigger re-establishment or log faults in normal and aggressive modes.

Configure stp udld lab to enable udld on switch interfaces, using normal and aggressive modes to detect unidirectional link failures and shut down faulty ports.

Explore how rapid spanning tree protocol (rstp) speeds convergence, embedding uplink fast and backbone fast, and enabling port fast to prevent frame looping in modern networks.

Compare STP and RSTP port states and explain how disable, blocking, listening, learning, and forwarding define discarding and forwarding on switch ports.

Explore the rapid spanning tree protocol convergence steps—proposal, synchronization, and agreement—and how they place transports in discarding state, elect the root, and designate blocking and root ports via BPDU exchanges.

Explore rstp port types—edge ports, root ports, designated ports, and point-to-point ports—and learn how they influence connectivity and lowest-cost paths to the root.

Explore the evolution of spanning tree protocols from 802.1D STP to VLAN-aware PVST and PVST+, CST, and rapid spanning tree for faster convergence.

Learn how MSDE’s multiple spanning tree enables load balancing across lanes and root-port decisions. See how common databases across VLAN groups 1–5 and 6–10 are managed.

Learn MSDE protocol, map VLAN groups into MSDE instances, with default zero, configure up to 16 instances, and use BPDU hash exchanges to verify regional membership.

Explore rapid pvst plus configuration on Cisco switches, including trunk setup, interface range configuration, root bridge priority, port costs, uplink fast and backbone fast, and vlans load-balancing with 1:1 mappings.

Configure MST instances and VLAN mappings, verify root port roles, and leverage uplink fast and backbone fast to optimize spanning-tree behavior in the MST configuration lab.

Learn ether-channel basics: bundle links of the same speed and duplex using Cisco proprietary PDP and open standard link aggregation control protocol, with desirable, auto, active, and passive modes.

Explore the XOR gate introduction, its two inputs, and the output behavior for load balancing, including the truth table where different inputs yield high and same inputs yield low.

Discover ether channel load balancing by examining hash algorithms that use source and destination MAC addresses, IPs, and ports, and see how link counts affect bit selection.

Explore ether-channel load balancing using source MAC to select the proper link. Learn how leftmost MAC binary bits determine link choice across 2, 4, and 8-port configurations.

Explain ether-channel load balancing by using the destination MAC to choose the active link across two or four links, based on the destination MAC address bits.

Learn how ether-channel load balancing uses source IP address to select among multiple links, illustrated with diagrams and binary-based decisions for various link counts.

Explore how ether-channel load balancing uses the destination IP to select among multiple links, converting IPs to binary and mapping to link numbers in various topologies.

Learn to implement IP-based load balancing by converting source and destination IP addresses to binary and using a two-bit or three-bit selector to distribute traffic across multiple links.

Explore ether-channel load balancing by source port hashing, where you convert the source port to binary and use the leftmost bits to select among two, four or more links.

Learn how ether-channel load balances traffic across multiple links using destination port numbers (dst-port). The lecture demonstrates link selection and traffic distribution based on ports.

Learn ether-channel load balancing using src-dst-port, mapping source and destination port numbers to multiple links, and selecting links based on computed x values to distribute traffic.

Configure layer 2 etherchannel on switches using trunked links, configure port-channel groups with lacp active, verify with show commands, adjust load balancing, and review spanning-tree outcomes.

Configure layer 3 etherchannel between two switches, assign correct IP addresses to the channel and routed interfaces, enable routing, and verify end-to-end reachability with connected PCs.