14.9.11 Packet Tracer - Layer 2 Vlan Security -

Happy (secure) switching.

That’s where comes in. It’s the often-overlooked foundation of network defense.

Let’s break down what this lab teaches and why it matters in the real world. Imagine you are responsible for a corporate network. Users are in VLAN 10 (Employees) and VLAN 20 (Guests). The lab presents a simple topology: one multilayer switch (distribution), one layer 2 switch (access), and a few PCs.

Take the time to run this lab. Break it on purpose. Watch the show port-security , show dhcp snooping binding , and show interfaces status err-disabled outputs. 14.9.11 packet tracer - layer 2 vlan security

Disable DTP and set trunking manually.

Never use VLAN 1 for anything. Not for native VLAN, not for management, not for users. VLAN 1 is the universal key to many Layer 2 attacks. Step 4: DHCP Snooping – Stopping the Rogue Server The Threat: An attacker plugs in a laptop running a rogue DHCP server. When legitimate clients broadcast for an IP, the rogue server replies first, giving them a malicious gateway (the attacker) or a bogus DNS server (phishing).

DHCP Snooping.

On any port that should not be a trunk (i.e., all end-user ports), explicitly turn off trunking:

Layer 2 security is invisible when done right. But when it's missing, the whole network crumbles. What other Layer 2 attacks worry you most—CDP/LLDP recon, STP manipulation, or ARP poisoning? Drop a comment below.

Port Security.

ip dhcp snooping ip dhcp snooping vlan 10,20 interface g0/1 ip dhcp snooping trust interface range fa0/1-24 ip dhcp snooping limit rate 10 no ip dhcp snooping trust Now, only the uplink port can send DHCP Offer/ACK messages. Any rogue server on an access port will be ignored.

interface g0/1 switchport trunk native vlan 999 Then, ensure VLAN 999 exists but is used nowhere else. No user devices, no DHCP, no routing.

The four techniques in form the backbone of the Cisco Cyber Threat Defense model: Happy (secure) switching

Cisco’s Packet Tracer activity is an excellent, hands-on lab that forces you to think like both a network admin and a hacker. It focuses on three critical Layer 2 vulnerabilities and their mitigations: MAC Flooding , VLAN Hopping (Switch Spoofing) , and DHCP Starvation .