ccna 200-301 libro

ccna 200-301 libro.Traffic in the data plane consists primarily of user-generated traffic that is forwarded between routers. Data plane security can be implemented using ACLs, anti-spoofing mechanisms, and Layer 2 security features. ACLs control which packets are transmitted through the network and which packets can be released by performing packet filtering. ACLs are used to secure the data plane in a variety of ways, as shown below.Blocking unwanted traffic or users: an ACL can filter inbound or outbound packets on an interface. It can control access based on source address, destination address, and user authentication.Reduce the chance of DoS attacks: ACLs can be used to specify whether traffic is coming from a host, a network, or is generated by a user accessing the network. TCP blocking features can also be configured to prevent servers from being flooded with connection requests.Mitigate spoofing attacks: ACLs allow security practitioners to implement recommended practices to mitigate spoofing attacks.Provide bandwidth control: ACLs on slow links can prevent an influx of excessive traffic.Classify traffic to protect the management and control planes: ACLs can be applied on VTY lines. ACLs can also be used as an anti-spoofing mechanism by discarding traffic with invalid source addresses. This forces the attack to be initiated by a valid and reachable IP address, thus allowing the originator of the attack to be found by tracing the packet. Features such as Unicast Reverse Path Forwarding (uRPF) can be used to aid in the anti-spoofing strategy.CiscoCatalyst switches can use integrated features to protect Layer 2 infrastructure. The following are Layer 2 security tools that are integrated into CiscoCatalyst switches.Port security: protects against MAC address spoofing and MAC address flooding attacks.DHCP spoofing: Prevents DHCP server and client attacks on the switch.Dynamic ARP Inspection (DAI): Secures against ARP in a way that minimizes the impact of ARP poisoning attacks and spoofing attacks through the use of DHCP spoofing tables.