Medianet Reference Guide - Cisco

Auto Smartports
Chapter 7
Medianet Auto Configuration
Table 7-16
Configuration Example 7—Overridden Custom Macro Within the Switch
Configuration
!
macro auto execute CISCO_CUSTOM_EVENT
ACCESS_VLAN=402 {
if [[ $LINKUP -eq YES ]]; then
conf t
interface $INTERFACE
exit
end
fi
if [[ $LINKUP -eq NO ]]; then
conf t
interface $INTERFACE
switchport access vlan
$ACCESS_VLAN
exit
end
fi
}
!
The overridden macro example simply places the switchport into VLAN 402 when it goes into a link
down state. Note that the VLAN can either be hardcoded into the overridden macro or passed in via a
variable declaration as shown in this example.
Security Considerations
CDP and LLDP are not considered to be secure protocols. They do not authenticate neighbors, nor make
any attempt to conceal information via encryption. The only difficulty in crafting a CDP packet is that
the checksum is calculated with a non-standard algorithm. Even this has been reversed engineered and
published in public forums. As a result, CDP and LLDP offer an attractive vulnerability to users with
mal-intent. For example, by simply sending in a CDP packet with the “S” bit (otherwise referred to as
the switch bit) set in the capabilities TLV, the switch can be tricked into configuring a trunk port that will
pass all VLANs and accept 802.1d BPDUs from the hacker. This could be used in man-in-the-middle
(MIM) attacks on any VLAN in the switch. Below is an example of a CDP spoofing device that has set
the switch bit. Notice that the platform is set to a DMP. An obvious give-away in this example is the host
name, CDP Tool1, which was chosen to be obvious. Normally the host name would have been selected
to make the device appear to be a legitimate DMP device.
me-w-austin-3#sh cdp neigh g1/0/39
Capability Codes: R - Router, T - Trans Bridge, B - Source Route Bridge
S - Switch, H - Host, I - IGMP, r - Repeater, P - Phone,
D - Remote, C - CVTA, M - Two-port Mac Relay
Device ID Local Intrfce Holdtme Capability Platform Port ID
CDP Tool1 Gig 1/0/39 30 S DMP 4305G eth0
Because the switch policy ignores the platform, this field can be used to make the entry appear to be
legitimate while still tricking the switch to configure a trunk, as shown below.
!
interface GigabitEthernet1/0/39
location civic-location-id 1 port-location
floor 2
room Broken_Spoke
7-22
Medianet Reference Guide
OL-22201-01