Cisco learning / Module 27
MODULE 27 / SECURITY FUNDAMENTALS / NETWORK ACCESS

Layer 2 and Wireless Security

Protect access ports and wireless networks using port security, DHCP snooping, DAI, and modern WLAN security.

CCNA 200-301SECURITY FUNDAMENTALS / NETWORK ACCESS3 QUESTION QUIZ

Learning objectives

  • Explain the purpose and scope of Layer 2 and Wireless Security.
  • Identify important protocols, roles, fields, and terminology.
  • Apply the concept to a practical network scenario.
  • Use IOS XE commands to verify operational behavior.

1. Core concepts

Port security limits the source MAC addresses allowed on a switch access port. Static or sticky secure MAC addresses can be used. Violation actions include protect, restrict, and shutdown, with exact behavior depending on mode. Port security is commonly used on edge/access ports, not indiscriminately on trunks.

2. How it works

DHCP snooping distinguishes trusted and untrusted switch ports and blocks unauthorized DHCP server messages on untrusted ports. It builds a binding table. Dynamic ARP Inspection validates ARP packets against trusted bindings to reduce ARP spoofing. IP Source Guard can use binding information to restrict source IP/MAC traffic. WLAN security should use WPA2-AES or WPA3 and enterprise 802.1X where appropriate.

Visual walkthrough

Access port securityDHCP snoopingDAI validationSecure WLAN authenticationConceptual flow; refer to the lesson for protocol details and exceptions.
Original conceptual diagram for Layer 2 and Wireless Security.

3. Worked example

Trust uplinks toward legitimate DHCP servers and leave user-facing ports untrusted. Enable DHCP snooping for the VLANs, then DAI where supported. On wireless, avoid WEP and legacy TKIP. Use WPA3 or WPA2-AES, strong credentials, and 802.1X/RADIUS for enterprise access.

IOS XE commands and verification

Syntax and feature availability can vary by device family and software release. Confirm platform support before applying configuration.

interface gi1/0/10
 switchport mode access
 switchport port-security
 switchport port-security maximum 2
 switchport port-security mac-address sticky
ip dhcp snooping
ip dhcp snooping vlan 10,20
ip arp inspection vlan 10,20
show port-security interface gi1/0/10
show ip dhcp snooping binding

Common mistakes and troubleshooting

  • Check physical and interface state before changing higher-layer settings.
  • Verify both ends agree on addressing, VLAN, encapsulation, and protocol parameters.
  • Use operational show commands; configured text alone does not prove a feature is working.
  • Change one variable at a time and verify the result.

Knowledge check

Choose one answer per question. Submit to see why the correct choice is right and why every other option is wrong. These are original practice questions, not Cisco exam questions.

Layer 2 and Wireless Security quiz

3 questions · explanations for every option · retry enabled

Question 1What does port security limit on a switch port?
Question 2Which switch port should normally be trusted for DHCP snooping server messages?
Question 3What does Dynamic ARP Inspection validate?