Why Layer 2 security matters
Before a packet reaches a router or firewall, it depends on Ethernet switching, VLANs, ARP or Neighbor Discovery, DHCP, and spanning tree. Attacks or mistakes inside the local LAN can therefore disrupt traffic before routed security controls ever see it.
Layer 2 security establishes trust at the access edge and protects the control mechanisms that make a switched network usable.
Trust model at the access layer
Classify ports by role: user access, wireless AP, phone, server, trunk, uplink, and management. Decide which ports are allowed to send infrastructure messages such as DHCP server replies or spanning-tree control traffic. Security features such as DHCP snooping rely directly on this trusted/untrusted distinction.
A clear port role model is easier to audit than a collection of one-off exceptions.
Unused ports and baseline configuration
Administratively disable unused access ports where practical and place them in a defined unused VLAN rather than leaving default behavior. Apply consistent descriptions, access mode, VLAN assignments, and security policy through templates.
Baseline configuration reduces accidental exposure and makes deviations easier to detect.
Port security and MAC control
Port-security features can limit which or how many MAC addresses are learned on an access port and define an action when policy is violated. This can reduce accidental bridging or simple unauthorized device attachment.
It is not identity by itself because MAC addresses can be changed or spoofed. Use it as one layer rather than as the only admission control.
802.1X and access control
IEEE 802.1X provides port-based network access control. A supplicant authenticates through an authenticator such as a switch or AP to an authentication server, commonly using RADIUS. Successful identity can lead to authorization decisions such as VLAN or role assignment.
Plan fallback behavior for devices that cannot use 802.1X and avoid creating uncontrolled bypass paths.
DHCP snooping
DHCP snooping distinguishes trusted ports that may legitimately send DHCP server messages from untrusted access ports. It can block rogue server responses and build a binding database that maps client MAC, IP, VLAN, and port information.
That binding table can feed other protections such as Dynamic ARP Inspection and IP Source Guard.
Dynamic ARP Inspection
Dynamic ARP Inspection validates ARP traffic on untrusted ports, often against the DHCP snooping binding database. It helps prevent forged ARP mappings that would redirect traffic through an attacker or disrupt local connectivity.
Static-address environments require planning because legitimate hosts may not appear in DHCP bindings. Use explicit exceptions or alternative validation where needed.
IP Source Guard
IP Source Guard restricts source IP behavior on access ports based on trusted bindings or configured policy. It can reduce source-address spoofing inside a VLAN.
As with DAI, understand how static addressing and non-DHCP devices are handled before broad deployment.
STP protections
Spanning Tree Protocol controls loop-free Layer 2 topology, so untrusted topology changes can have large impact. Features such as BPDU Guard can disable an edge port if unexpected BPDUs appear, while Root Guard can prevent a port from becoming a path to an unauthorized root bridge.
Use edge-port features only where the topology guarantees that another switch should not legitimately connect.
Storm control and loops
Broadcast, multicast, or unknown-unicast storms can consume link and switch resources. Storm-control features limit traffic above configured thresholds and can reduce the impact of loops or malfunctioning devices.
Thresholds should match normal traffic patterns. Overly aggressive settings can drop legitimate discovery or application traffic.
Trunks and VLAN hopping
Do not allow endpoints to negotiate trunks unless the design requires it. Configure trunk state explicitly, restrict allowed VLANs, and choose native VLAN behavior intentionally. Avoid using default VLAN assumptions as a security boundary.
Trunks are infrastructure links and deserve a stricter trust model than ordinary access ports.
ARP, IPv6, and Neighbor Discovery
IPv4 uses ARP, while IPv6 relies on Neighbor Discovery and ICMPv6. IPv6 access networks need equivalent attention to rogue router advertisements, neighbor spoofing, and address-autoconfiguration behavior.
Do not apply IPv4-only protections and assume IPv6 is covered. A dual-stack LAN has two control ecosystems to secure.
Relationship with Wi-Fi
Wireless LANs extend Layer 2 access through APs and controllers. Authentication, VLAN assignment, client isolation, DHCP, and upstream switch trunks all affect the final security posture. Enterprise WLAN commonly integrates 802.1X and RADIUS with the same identity infrastructure used by wired access.
Coordinate wired and wireless policy so users do not gain broader access simply by changing media.
MAC flooding and learning control
Switches learn source MAC addresses into forwarding tables. Excessive or malicious churn can pressure those tables and complicate forwarding. Port-security limits, control-plane protections, and monitoring of MAC movement can reduce exposure.
Sudden large-scale MAC movement may also indicate loops or misconfigured virtualization, not only malicious activity.
Hardening trunks and infrastructure links
Restrict trunks to required VLANs, configure both ends consistently, disable dynamic negotiation when unnecessary, and document native VLAN behavior. Protect links between switches, APs, hypervisors, and routers according to their role.
An over-permissive trunk expands the Layer 2 failure and attack domain far beyond what most endpoints need.
Deployment and troubleshooting
Roll out access-layer controls in stages. Baseline normal devices, enable logging, test representative endpoint types, and understand violation behavior. When a client loses connectivity, inspect authentication state, DHCP snooping bindings, DAI drops, port-security counters, VLAN assignment, and STP state.
Use packet captures and switch counters together to distinguish policy drops from ordinary connectivity failures.
Continuous operation and exceptions
Maintain an inventory of approved exceptions for printers, phones, building systems, and other devices with different capabilities. Review unused exceptions and stale MAC bindings periodically.
Security features work best when operations teams can explain why a port behaves differently rather than inheriting undocumented bypasses.
References and next step
Relevant standards include IEEE 802.1X, IEEE 802.1Q, and the protocol specifications for DHCP and IPv6 Neighbor Discovery. Vendor platforms provide additional protections and naming conventions.
Continue to network firewalls to move from access-layer trust to stateful policy between routed zones.