Are there any kind of security functions that typically must be provided by a switch, because these security features cannot be run on a firewall (which typically works on layer 3 = IP layer and above)?

I was thinking about some kind of ARP protection that it operates at layer 2, but I actually don't know whether any switch offers this kind of protection. What are some other security functionality in this category?

  • What do you mean by 'must'? Do you mean what can a switch do that a firewall cannot? Have you looked at the documentation for switches and the security features they provide? What about MAC filtering? Does that count?
    – schroeder
    Commented Oct 25, 2016 at 21:51
  • first hit on a Google search: ciscopress.com/articles/article.asp?p=1181682
    – schroeder
    Commented Oct 25, 2016 at 21:51
  • @schroeder Maybe I should have changed that "must" to "should". The links is helpful. And yes ARP protection seems like an option here. MAC filtering also should work if we assume that firewall works layer 3 and up.
    – typos
    Commented Oct 25, 2016 at 21:54
  • This is a really broad question. There is a long list of things that can be done at layer 2. Is there something specific or some effect you are interested in?
    – schroeder
    Commented Oct 25, 2016 at 21:59

1 Answer 1


There are a number of security features that can only be implemented on layer two.

802.1X is used to authentificate hosts and to prevent unauthenticated hosts from becoming a part of your network. // As mentioned above you can also whitelist/blacklist devices based on their MAC but this is not as reliable as 802.1X because the MAC address of a device can be faked relatively easy.

VLANs can be used to switch different networks on a switch. This can be used to segment a network wich can increase the security when done correctly. VLANs can also be used in combination with 802.1X to isolate hosts when they violate a policy you want to enforce.

Port Security can be used to limit the devices that can be attached to a single port. This prevents the flooding of the CAM table of switches. This would otherwise cause the switch to downgrade to a HUB or a DoS. Also Port Security can be used to prevent other attacks that operate on a higher layer but can only be prevented when you are able to include a lower layer. For example limiting DHCP to a specific physical port.

Spanning Tree is used to prevent networking loops. Loops are mostly created by accident but can also be used by intentionally to cause a DoS.

Storm Control is related to spanning tree and helps to supress traffic generated by a packet storm or even to shut down the ports that are affected.

  • 2
    And don't forget VLANs, which are implemented at layer 2 as well. Commented Oct 25, 2016 at 22:09

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .