In the last lecture we’ve seen how to attack Spanning Tree by claiming the RootBridge Role. In this
video
I'll show you what countermeasures you can take to protect STP and your switches. If your swich supports
STP, which is a protocol supported only by professional switches,
it should also have some features in the operating system to protect against STP attacks.
In this lab I'll show you how to protect the Cisco Catalyst Switch against STP attacks.
Other vendors have similar features available. Fortunately the countermeasures to a root takeover attack
are simple and straightforward.
There are two measures you can take to mitigate this attack:
BPDU-guard and Root guard.
Let's see them one by one!
BPDU-Guard is a feature that comes with PortFast and is applicable to access layer switches.
This feature allows the network designers to enforce the STP domain borders devices behind ports with
BPDU-guard enabled are unable to influence the STP topology. And this is the case when a host is running
Yersinia and wants to take over the root. At the reception of a BPDU frame, so a frame that carries
STP messages BPDU-guard disables the port which will move into the error disable state, and a message
is generated.
BPDU-guard accompanies another feature called PortFast which allows a port to transit directly into
the forwarding state when the link is up.
This feature must therefore be enabled only on ports where no switch will ever be connected and those
are access parts.
Okay, let's return to the Switch and enable BPDU-guard and then portfast on the access port
to which the host that runs Yersinia is connected. That's interface
FastEthernet 0/0
conf t I am entering the interface configuration mode interface FastEthernet0/1 spanning
tree bpduguard enable
This command has enabled BPDU guard and I'm also enabling portfast so: spanning-tree portfast
The command has effect only when the interface is in a non trunking mode. I have enabled BPDU guard and
portfast on that interface.
You can also enable BPDU guard on all portfast ports of the Switch so in global configuration
mode you execute: spanning-tree portfast bpduguard default Let's reproduce the attack! I am going
to Kali Linux and I am starting Yersinia in GUI mode so: yersinia -G Launch Attack
stp and ClaimingRootRole and ok
and we notice the messages, in the console we see how BPDU guard has put the port in error disabled
state; the port received a BPDU and the that's not allowed.
I am stopping the attack.
Now you can re-enable the port to manually by executing shut and no shut like this: shut and no shut and
the port's up; or you can execute errdisable recovery command ; in global configuration mode
I run: errdisable recovery cause bpduguard
and errdisable recovery interval 600
These two commands will automatically enable the port after 600 seconds or 10 minutes if the
port was shut down by bpdu-guard and no other BPDU frames are received on that port. The default
recovery interval is 300 seconds or 5 minutes. Note that there is the possibility
for an attacker to bypass BPDU-guard depending on how the switch is configured. As I've previously
said BPDU-guard relies on PortFast, and when enabling PortFast on a port the switch operating
system produces a warning. Let's see
the warning
This is the warning, it states that PortFast will only have effect when the interface is in a non
trunking mode.
This means that an attacker who has the ability to enable trunk mode on the port has also the ability
to disable PortFast and therefore to disable BPDU guard all altogether.
This is Dynamic Trunking Protocol (DTP) exploitation that can also be performed using Yersinia and
to avoid this attack
you should set to the port as a static access port; by default the switch port is in dynamic desirable
mode and that means that it will try to auto negotiate with the other side switches interface if they
create a trunk or not and remain access ports.
So in interface configuration mode I'll execute: switch port mode access; I set the port as a static
access port.
This was all about the BPDU-guard. Another security feature used to protect against STP attacks
is called root guard. Root Guard can be applied on distribution layer switches while applying BPDU
guard on access layer switches.
Let's see what Root Guard does. Root Guard does not prevent STP communication on the port where it is
enabled, but it will only react to BPDU frames which would lead to the election of a new root bridge behind
protected ports.
This way a Root Guard enforces the position of the Root Bridge. A violation of the Root guard policy
and that means receiving a superior BPDU on a port where the Root Guard was enabled results in the
port being temporarily set to root inconsistent state and not forwarding any frame. The port connectivity,
so the forwarding state, will be automatically re-enabled as soon as no illegal or superior BPDUs are received
on the port. In our example
we want a fixed rootBridge and we’re gonna enable root guard on all its ports. Let's see how many
interfaces has the switch.
sh ip interface brief
It has 48 FastEthernet interfaces and 2 Gigabit interfaces.
I'm gonna enable Root Guard on all FastEthernet interfaces so conf t interfacerange f 0/1 -
48 and spanning-tree root guard
sorry.
spanning-tree guard root
OK, Root Guard was enabled!
Before launching the attack again I want to disable BPDU guard
on FastEtherenet0/1; I want on the interface only root Guard enabled
so: no spanning-tree bpdu guard enable
and I am disabling BPDU guard
also globally so: spanning-tree portfast
bpdu guard default
Let's check the configuration of FastEthernet 0/1 interface: do sh run
only Root Guard
is enabled.
Let's launch the attack again! In Yersinia
I'm selecting the STP tab and clicking ClaimingRootRole; and we notice how Root Guard has blocked portfast
Ethernet0/1. Let's check the interface state with the following command: sh spaning-tree
vlan1 and we notice how the interface is the Root inconsistent state or sh spanning-tree
interface f0/1 detail ; root inconsistent
To disable Root guard in interface configuration mode use spanning-tree guard none and I've disabled
a Rood guard on that interface.
Congratulations, you've just learned how to protect your switches against STP attacks!