## Network Switches: Configuration Guide

Network switches are the core of a local area network. This page explains how they work, where they're used, and the most common configuration mistakes that impact security and performance.

### What Are Network Switches?

Network switches operate at Layer 2 of the OSI model and connect devices inside a LAN. They forward frames based on MAC addresses and create separate collision domains per port, improving efficiency and performance.

### How Switches Work

- Learn MAC addresses of connected devices
- Maintain a MAC address forwarding table
- Forward frames based on destination MAC
- Provide full-duplex communication on each port
- Reduce collisions through per-port isolation

### Common Uses

- Connecting PCs, printers, VoIP phones in offices
- Segmenting workloads in data centers
- Providing wired backhaul for wireless access points
- Connecting IoT devices in smart buildings
- Implementing VLANs and redundant network paths

## 🚨 Common Switch Misconfigurations

Misconfigurations are a major cause of outages and security incidents. Below are the most frequent problems seen in real networks.

### 1. Default Credentials & Settings

Example: leaving `admin/admin` or no password configured.

- Unauthorized access to network infrastructure
- Full network compromise from a single device
- Compliance violations (PCI-DSS, HIPAA, GDPR)

### 2. Improper VLAN Configuration

Incorrect VLAN assignments or trunk settings that don't match the design.

- Unintended cross-department access
- Bypassing segmentation and security policies
- Traffic leakage between isolated environments

### 3. Spanning Tree Protocol (STP) Issues

Disabling STP or mis-tuning priorities across switches.

- Broadcast storms and MAC-table instability
- Total LAN outages caused by loops

### 4. Port Security Neglect

No MAC limiting, sticky MAC, or violation actions.

- Unauthorized devices joining the network
- MAC spoofing and ARP-based attacks
- Rogue or compromised IoT devices staying hidden

### 5. Trunk Port Misconfigurations

Allowing all VLANs on trunks or using an incorrect native VLAN.

- VLAN hopping and double-tagging attacks
- Traffic from restricted VLANs appearing on other links

#### ⚠️ Why This Matters

A single badly configured switch can bring down a building or campus network. Standardized templates and Python-driven automation (like AutoSec) help prevent these errors and keep configurations consistent.