Layer 2 Security practice questions

Broadcast, unknown unicast, and multicast traffic.

Storm control on EX Series switches applies to broadcast, unknown unicast, and multicast traffic by default when configured with a bandwidth-percentage rate limit. This satisfies the stem's requirement to protect against broadcast floods while also covering the other flooding traffic types, since all three are grouped under the default storm control profile.

show ethernet-switching storm-control interface ge-0/0/1

The `show ethernet-switching storm-control interface ge-0/0/1` command displays per-interface storm control configuration alongside live statistics, including dropped packet counters for broadcast, multicast and unknown unicast traffic. This directly satisfies the stem's requirement to verify both storm control statistics and drop counts on a specific EX Series interface.

show macsec connections

The MKA session must reach Secured state before MACsec can pass traffic, so 'show macsec connections' exposes the connectivity association, peer state and key server election, pinpointing whether the PSK mismatch or CAK/CKN error prevents the secure channel from establishing.

set switch-options interface ge-0/0/1.0 mac-limit limit 2

This statement correctly sets the MAC limit to two on the specified interface under switch-options.

set ethernet-switching-options secure-access-port vlan VLAN10 arp-inspection

DAI is enabled under the secure-access-port hierarchy, scoped to a VLAN by name, with the arp-inspection statement. This command matches the stem's requirement to enable Dynamic ARP Inspection for the specific VLAN10, binding inspection to that broadcast domain.

set ethernet-switching-options secure-access-port interface ge-0/0/5 ip-source-guard ip-mac-verify

The `ip-mac-verify` parameter extends IP Source Guard beyond source-IP checking, forcing the switch to validate both the source IP and source MAC against the DHCP snooping binding table. This directly satisfies the stem's requirement to verify both addresses, whereas plain `ip-source-guard` alone checks only the IP address.

LLDP frames are processed by the control plane or hardware before ingress port firewall evaluation.

LLDP terminates at the control plane, so Junos processes these frames before the ingress port filter's discard action applies. Layer 2 firewall filters cannot block control-plane–destined traffic such as LLDP; the filter never sees it. To suppress LLDP on an access port, disable it under the interface or protocol hierarchy instead.

from source-mac-address 00:11:22:33:44:55

This term syntax correctly matches the source MAC address in a Layer 2 firewall filter.

Option-82 checks are enabled, and the incoming client request fails validation rules.

DHCP snooping drops client DHCP Request messages on untrusted ports when Option-82 validation fails, since the relay agent information field is checked against configured rules. The stem's constraint — requests dropped on untrusted access ports — matches this validation failure, not a missing trusted-port designation.

show macsec connections

The 'show macsec connections' operational command displays MACsec connection status along with associated security association parameters, such as keys and replay protection counters. It directly satisfies the requirement to view MACsec connection and security association status on an EX Series switch.

show ethernet-switching secure-access-port ip-source-guard interface

The `show ethernet-switching secure-access-port ip-source-guard interface` command lists every interface with IP Source Guard configured, plus its operational state, directly satisfying the stem's requirement to identify enabled interfaces and their status. It queries the secure-access-port subsystem, so it reports DHCP snooping binding-driven filtering state per interface rather than static configuration alone.

set ethernet-switching-options storm-control interface ge-0/0/2 bandwidth 10m

The bandwidth keyword accepts an absolute rate value, so bandwidth 10m sets a 10 Mbps limit rather than a percentage of link speed. This satisfies the question's requirement to specify the storm-control rate limit in absolute bandwidth on the ge-0/0/2 interface.

Configurable violation actions include drop, restrict, and shutdown.

Junos port security supports three violation actions: drop silently discards offending frames, restrict logs and drops, and shutdown disables the interface. This matches the stem's requirement for configurable violation actions, distinguishing it from technologies offering only a single fixed action.

It can limit the number of learned MAC addresses on a specific interface.

Port security caps the number of MAC addresses learned per interface, preventing MAC flooding and spoofing by limiting entries in the Ethernet switching table. This satisfies the stem's requirement, distinguishing it from features that filter by static MAC lists rather than learned-address counts.

Multicast traffic

Multicast traffic is monitored and policed by storm control by default.

Unknown unicast traffic

Unknown unicast traffic is included in default storm control monitoring.

Broadcast traffic

Broadcast traffic is monitored and policed by storm control by default.

Configure a static IP source entry in the secure-access-port binding table for the server.

DAI validates ARP packets against the DHCP snooping binding table; a static server has no DHCP lease, so adding a static IP source entry in the secure-access-port table gives DAI the trusted binding it needs without marking the whole port trusted.

Logging the violation event via syslog

Syslog logging is one configurable DAI violation response on EX Series switches, recording the offending event for audit and troubleshooting. It satisfies the stem by providing a non-disruptive action alongside drop and shutdown, letting administrators monitor ARP spoofing attempts without necessarily blocking traffic.

Incrementing DAI drop counters

Counters track dropped invalid ARP packets for operational visibility.

Dropping the violating ARP packet

Dropping the violating ARP packet is a configurable DAI response, discarding frames whose sender MAC and IP bindings fail the DHCP snooping or static binding check. It satisfies the stem by directly preventing spoofed ARP entries from being installed, blocking the attack at the interface.

show ethernet-switching dhcp-snooping binding

`show ethernet-switching dhcp-snooping binding` verifies DHCP snooping, the mechanism underpinning secure access port features such as dynamic ARP inspection and IP source guard. It satisfies the stem's requirement for an operational command by displaying snooped IP-to-MAC bindings per VLAN, confirming that untrusted access ports have learned legitimate bindings.

show ethernet-switching secure-access-port ip-source-guard interface

`show ethernet-switching secure-access-port ip-source-guard interface` is a valid Junos operational command that displays IP source guard bindings per interface, verifying DHCP snooping-derived address bindings that filter spoofed source addresses on untrusted access ports. It directly satisfies the stem's requirement for verifying secure access port features.

The incoming interface is explicitly configured as a trusted interface for DAI.

Trusted interfaces bypass DAI's DHCP snooping binding-table validation entirely, so ARP packets arriving there are forwarded without inspection. This satisfies the stem's requirement for a condition permitting successful forwarding, since DAI drops ARP from untrusted ports lacking a matching binding entry.

The sender's IP and MAC address match an entry in the DHCP snooping binding database.

Dynamic ARP Inspection validates ARP packets against the DHCP snooping binding database, which maps IP addresses to MAC addresses on trusted leases. Requiring the sender's IP and MAC to match an existing binding entry satisfies DAI's core validation constraint, ensuring spoofed or forged ARP packets are dropped rather than forwarded on the access port.

Verifying MKA peer connectivity state using 'show macsec connections'.

The `show macsec connections` command exposes MKA session state, confirming whether the CAK-derived secure channel is established between peers. Since MACsec only forwards traffic once MKA completes, checking peer connectivity directly satisfies the stem's requirement to verify the key-agreement layer before investigating data-plane encryption faults.

Verifying that pre-shared key (CAK and CKN) configurations match on both peer switches.

MKA derives session keys from the connectivity association key and name; mismatched CAK or CKN values on the two peers cause authentication failure, so verifying both configurations match is essential before the secure channel can establish.

Checking encryption and decryption packet error counters.

Checking encryption and decryption packet error counters directly exposes MACsec frame protection failures, such as integrity check value mismatches or cipher suite mismatches between peers. Because MACsec secures the link at Layer 2, these counters reveal whether the MKA-derived secure association keys are actually encrypting and decrypting traffic correctly.

restrict

Restrict is a valid violation action: the switch drops frames from the offending MAC while leaving the port up, and logs the violation. It satisfies the question's requirement for a genuine Junos port-security violation action, unlike non-existent options such as 'protect' or 'notify'.

shutdown

Shutdown is a valid violation action: on detecting a MAC limit breach the switch err-disables the interface, dropping all traffic until it is manually cleared. It meets the question's requirement for a genuine Junos port-security violation action alongside restrict.