Plug a laptop into a switchport in most networks and, by default, it is trusted completely. It can flood the CAM table, hand out DHCP leases, poison ARP caches, spoof its source IP, talk to every other host in the VLAN, and even elect itself the spanning-tree root. The default Layer 2 posture is wide open, because Ethernet was built for a world where physical access meant you were allowed. Every control in this checklist closes one specific door in that open house. This is the roundup for the PingLabz VLANs and Layer 2 switching cluster and the network infrastructure security guide: each control mapped to the exact attack it stops, and, wherever we could, a way to prove it on a real switch. Several of the proofs below were captured live on Cisco IOL-XE in CML.
Why the default is dangerous
A switch does its job by trusting what it hears. It learns MAC addresses from whatever frames arrive, it forwards DHCP from anyone, it caches ARP from any reply, and it runs spanning tree with any device that speaks BPDUs. None of that involves a check on whether the sender should be doing it. That is not a flaw so much as the absence of a feature, and the features that add the checks are exactly the hardening controls below. The goal of L2 hardening is to replace blanket trust with specific, verifiable trust: this port may have this MAC, that server is the only DHCP source, this host owns this IP-and-MAC pair, these ports may not talk to each other. Assemble the full set and the wide-open port becomes a port that only does what you intended.
The control-to-attack map
Each card below names a control, the attack it defeats, and how you would prove it works. "Proven here" means the drop was captured live in the CML lab behind this cluster; the rest link to the deep-dive that walks the configuration and verification.
Port security stops CAM overflow
A switch learns MAC addresses into its CAM table by watching source addresses. Fill that table with thousands of fake MACs and the switch runs out of room and fails open, flooding unknown-destination frames out every port - which is exactly what an attacker wants, because it turns the switch into a hub they can sniff. Port security caps how many MACs a port may learn and reacts (protect, restrict, or shutdown) when the cap is exceeded. It is the first control every access port should have. The mechanics of the table it protects are covered in how switches learn MAC addresses, and the broader per-port hardening it belongs to is in VLAN security hardening.
DHCP snooping stops rogue DHCP
Any host on a VLAN can answer a DHCP request. A rogue server can hand a victim a bad default gateway (itself) and become a man-in-the-middle, or exhaust the real server's pool (starvation) so nothing gets an address. DHCP snooping designates the real server's port as trusted and drops server-side DHCP messages (OFFER, ACK) arriving on any untrusted port. As a bonus, it builds the IP-to-MAC-to-port bindings table that DAI and IP Source Guard depend on. The full mechanism, including Option 82 and trusted ports, is in DHCP snooping in depth.
DAI and static ARP ACLs stop ARP poisoning (proven)
ARP has no authentication, so any host can claim any IP. Dynamic ARP Inspection validates each ARP against the snooping bindings, and where there is no DHCP, a static ARP ACL supplies the legitimate IP-to-MAC pairs by hand. This is the one attack we ran end to end. HOST2 fired eight forged ARP replies claiming HOST1's IP from HOST2's MAC, and DAI dropped all eight:
SW1#show ip arp inspection statistics vlan 120
Vlan Forwarded Dropped DHCP Drops ACL Drops
---- --------- ------- ---------- ---------
120 2 8 8 0Eight spoofed ARPs in, eight dropped, the man-in-the-middle dead on arrival. The full walkthrough, including the static keyword and the 15 pps rate-limit, is in static ARP ACLs: inspecting ARP without DHCP snooping. For the DHCP-backed version alongside IP Source Guard, see Dynamic ARP Inspection and IP Source Guard.
IP Source Guard stops IP spoofing
Even with ARP under control, a host can still forge its source IP to impersonate another machine or dodge an ACL. IP Source Guard uses the snooping bindings to pin each port to a specific IP-and-MAC and drops any frame whose source does not match. It is the natural partner to DHCP snooping and DAI, closing the source-address door those two leave ajar. The configuration and verification live in the same L2 security stack article.
VACLs stop lateral movement (proven)
A router ACL only sees traffic that routes between subnets, so it can never filter two hosts in the same VLAN. When an attacker compromises one host and pivots sideways to its neighbours, that traffic never touches the router. A VACL filters frames as they are bridged inside the VLAN, so it can. We proved it: the same intra-VLAN ping went from 0% loss to 100% loss the moment the VACL was applied, while the gateway ping still worked, showing it was the VACL and not a broken host. The before-and-after and the access-map config are in VLAN ACLs (VACLs): filtering traffic inside a VLAN.
Private VLANs stop the host-to-host pivot
Where a VACL filters specific flows, a private VLAN isolates hosts wholesale. Put every server in an isolated secondary VLAN and each one reaches the gateway but none can reach its neighbours, so a compromised server cannot pivot across the segment - all without a subnet per host. The isolated-plus-community association was built and confirmed on IOL-XE in this cluster. The full model, config, and the DMZ use case are in private VLANs: isolating hosts that share a subnet.
BPDU Guard and Root Guard stop STP takeover
Spanning tree trusts any device that speaks BPDUs, so a rogue switch (or a laptop running STP) can advertise a superior bridge ID, win the root election, and drag traffic through itself. BPDU Guard err-disables an access port the instant it receives any BPDU, on the logic that end hosts should never send them. Root Guard is gentler: it lets a port participate in STP but blocks it if it ever tries to become root, protecting your root placement on links to other switches you do not fully control. Both belong on the edge, and both are covered in the Spanning Tree Protocol complete guide. The related switch-spoofing and double-tagging tricks are in VLAN hopping attacks explained.
Storm control stops the flood
A broadcast, multicast, or unknown-unicast storm (from a loop, a misbehaving NIC, or a deliberate flood) can saturate a segment and take the whole VLAN down. Storm control rate-limits each of those traffic classes per port and drops the excess or err-disables the port once it crosses a threshold, containing the storm at the point it enters. The thresholds and configuration are in storm control: stopping broadcast floods at the port.
The order to turn them on
Sequence matters, because some controls depend on others. DHCP snooping comes first on any VLAN with DHCP clients, since its bindings table is the foundation that both DAI and IP Source Guard read from - enable them before snooping has learned anything and you will drop legitimate traffic. Port security, BPDU Guard, and storm control are independent and can go on every access port from day one; they need no shared state. DAI and IP Source Guard come next, once snooping is populated (or, for static segments, once your static ARP ACL is written). VACLs and private VLANs are design decisions layered on top, applied where the topology calls for intra-subnet isolation. A sane rollout is therefore: harden every access port with port security, BPDU Guard, and storm control; enable DHCP snooping and let it learn; turn up DAI and IP Source Guard against those bindings; then add VACLs or private VLANs where servers share a subnet.
Testing each control safely in a lab
The reason this cluster leans on CML captures is that every one of these controls is easy to misconfigure in a way that looks fine until it is attacked. The fix is to test the failure, not just the config. For each control, generate the exact attack it is meant to stop and confirm the drop: flood MACs past the port-security limit and watch the err-disable; offer a DHCP lease from an untrusted port and watch snooping discard it; fire forged ARPs with a tool like nping and read show ip arp inspection statistics; ping a same-VLAN neighbour before and after a VACL; send a BPDU into a guarded port and watch it shut. A control you have only ever seen in the running-config is a control you are trusting on faith. A control whose drop you have watched in show output is one you know works. That is the whole philosophy behind the proofs in this cluster, and it is why the static ARP ACL and VACL articles show the attack and the counter, not just the syntax.
Building the layered posture
No single control is the answer; the point is that each one closes a different door, and an attacker only needs one door left open. A hardened access port typically carries port security, DHCP snooping (with DAI and IP Source Guard riding on its bindings), BPDU Guard, and storm control all at once, with VACLs or private VLANs adding intra-subnet isolation where the design calls for it. Turn them on together and the wide-open default becomes a port that trusts only what you have explicitly allowed. Work through the deep-dives linked above, and use the VLANs and Layer 2 switching cluster and the network infrastructure security guide as your map for the rest.
Key Takeaways
- The default L2 posture is wide open: a plugged-in port trusts every MAC, DHCP offer, ARP reply, source IP, and BPDU it hears. Each control replaces blanket trust with a specific, verifiable check.
- Port security stops CAM overflow, DHCP snooping stops rogue DHCP, DAI plus static ARP ACLs stop ARP poisoning, IP Source Guard stops IP spoofing, VACLs stop lateral movement, private VLANs stop the host-to-host pivot, BPDU/Root Guard stop STP takeover, and storm control stops floods.
- Three defenses were proven live in this cluster: eight spoofed ARPs dropped by DAI, an intra-VLAN ping driven from 0% to 100% loss by a VACL, and a private VLAN isolated/community association confirmed up on IOL-XE.
- DHCP snooping is foundational: its bindings table feeds both DAI and IP Source Guard, so deploy it first on any VLAN with DHCP clients.
- Layer the controls. A hardened access port runs port security, snooping-backed DAI and IP Source Guard, BPDU Guard, and storm control together, with VACLs or private VLANs for intra-subnet isolation.
- Work through the linked deep-dives and use the VLANs and Layer 2 switching cluster and the network infrastructure security guide as the hub for the full picture.
