Layer 2 (Switch) Attack Mitigation Techniques

Solution	Description
Port Security	Prevents many types of attacks including MAC address flooding attacks and DHCP starvation attacks.
DHCP Snooping	Prevents DHCP starvation and DHCP spoofing attacks.
Dynamic ARP Inspection (DAI)	Prevents ARP spoofing and ARP poisoning attacks.
IP Source Guard (IPSG)	Prevents MAC and IP address spoofing attacks.

Always use secure versions of management protocols like SSH, Secure Copy Protocol (SCP), Secure FTP (SFTP), and Secure Socket Layer/Transport Layer Security (SSL/TLS)
Consider using out-of-band management network to manage devices
Use a dedicated management VLAN where nothing but management traffic resides
Use ACLs to filter unwanted access

These Layer 2 solutions will not be effective if the management protocols are not secured. The following strategies are recommended: