Raja's Exocortex

Ethernet Switch Best Practices

Best practices for ethernet switches for SOHO and enterprise networks.

Global Settings

  1. Set Hostname: hostname as per standards eg. flu-sw-core1

  2. Enable DNS: Configure DNS resolution to local servers. All servers (ntp, syslog, snmp trap, etc) must use DNS only and not IP. (Not available in all switches).

  3. Enable NTP: Enable NTP using hostname if permitted.

  4. Enable Syslog: send all logs to remote syslog server, use hostname for syslog server (eg syslog.example.lan).

  5. Enable SNMP v3 and Traps: setup SNMP v3 with secure credentials, trap server to be configured using FQDN and not IP (if permitted).

  6. Enable LLDP-MED: enable LLDP-MED and CDP to auto detect edge devices.

  7. Disable Insecure Protocols: disable SNMP v2, telnet, http to be disabled.

  8. Isolate Management Interface: switch CLI/SNMP/HTTP access must be restricted to management networks only, or use OOB ports exclusively for management. Switch console must not be reachable from end user networks.

Edge Ports

Ports to which desktops, laptops, and printers are connected.

  1. Enable STP BPDU Guard, Loopback Guard: this config disables the port of any STP BPDU packets are received. The port is disabled for a predefined period of time (eg. 60 seconds) and auto enabled after the timer expires. The switch should trigger an SNMP trap to the NMS when BPDU packets are detected. Cisco IOS example is below:
! 60 second auto recovery, global commands

configure terminal
	errdisable recovery interval 60
	errdisable recovery cause stp-bpdu-guard
	errdisable recovery cause stp-loopback-guard
	spanning-tree loopback-guard
  1. Rate limit BUM Traffic: Rate limit to be applied to broadcast, unknown unicast and multicast traffic to 10-100kbps. This is to prevent broadcast storms in the event of loops elsewhere in the network. Traffic exceeding this threshold should be dropped, the port should remain active. Cisco IOS example is below:
interface range GE 1 - 28
  storm-control broadcast kbps 100
  storm-control unicast kbps 100
  storm-control multicast kbps 10000
  1. Port Security Settings: restrict DoS and known bad traffic from ingress. Cisco IOS config is below:
! Global settings
configure terminal
security-suite enable global-rules-only
security-suite dos protect add stacheldraht
security-suite dos protect add invasor-trojan
security-suite dos protect add back-orifice-trojan

  1. Enable RSTP: RSTP+, PVST or MST to be enabled on all edge ports.

  2. Enable STP Edge Port Config: Enable Cisco Portfast to prevent the port from raising STP TCN messages when port changes between enable /disable states.

  3. Disable Port Status Change in Logs: disable logs for port up/down status change. Prevent log spam.

  4. MAC ID Limit: Limit the edge ports to a single MAC ID. This prevents more than one device from connecting to the edge ports (e.g. rogue switches and APs).

interface range GE 1 - 28
  switchport port-security
  switchport port-security maximum 1

  1. Enable Port Flap Dampening: administratively disable a port if it enables/disables too quickly (eg. 5 times within 30 seconds) and apply a restart timeout (120 seconds).

  2. Enable DHCP Snooping: block DHCP response packets from all edge ports. Protects against rogue DHCP servers.

Uplink Ports

Ports that connect between switches, ie. uplink ports.

  1. Enable RSTP: RSTP+, PVST or MST to be enabled on all uplink ports.

  2. LAG Config: Uplink ports must be part of a static LAG. LACP must be disabled.

  3. Port Monitoring: trigger an SNMP trap if an uplink port changes state - is disabled, interface speed or duplex change occurs.

  4. Enable Port Status Change in Logs: enable logs for port up/down status change.

  5. Enable UDLD: to detect cable errors.

  6. Optics Monitoring: enable all health checks in optical transceivers - signal/noise, temperature.

  7. Error Packets: monitor interface error packet counters (this is not available in the switch, but available in network monitoring tools).

  8. Enable Port Flap Dampening: administratively disable a port if it enables/disables too quickly (eg. 5 times within 30 seconds) and apply restart timeout (600 seconds).

  9. Set Port Description: to easily identify the port in NMS graphs. Eg. core-sw1 to ff-sw1.

Server Ports

Ports which servers connect within the data centre.

  1. Enable RSTP: RSTP+, PVST or MST to be enabled.

  2. Enable BPDU Guard, Loopback Guard: see above.

  3. Rate limit BUM Traffic: see above.

  4. Enable RSTP: RSTP+, PVST or MST to be enabled.

  5. Enable STP Edge Port Config: Enable Cisco Portfast to prevent the port from raising STP TCN messages when port changes between enable /disable states.

  6. Enable Port Status Change in Logs: enable logs for port up/down status change.

  7. MAC ID Limit: Limit the edge ports to a single MAC ID.

  8. Port Monitoring: trigger an SNMP trap if an uplink port changes state - is disabled, interface speed or duplex change occurs.

  9. Enable Port Status Change in Logs: enable logs for port up/down status change.

  10. Optics Monitoring: enable all health checks in optical transceivers - signal/noise, temperature.

  11. Error Packets: monitor interface error packet counters (this is not available in the switch, but available in network monitoring tools).

  12. Enable Port Flap Dampening: administratively disable a port if it enables/disables too quickly (eg. 5 times within 30 seconds) and apply restart timeout (600 seconds).

  13. Set Port Description: to easily identify the port in NMS graphs. Eg. sql-1.

  14. Static ARP: Configure static ARP to server ports to prevent ARP spoofing or duplicate IP addresses.