When people talk about network security, the conversation almost always starts at the perimeter: firewalls, VPNs, intrusion prevention, geo-blocking, and threat intelligence feeds. However, modern security threats frequently originate within the local area network (LAN), whether from compromised user devices, malicious insiders, or rogue hardware.
Layer 2 attacks typically happen on the LAN prior to network traffic reaching the firewall, thus preventing the firewall from defending against them.
The DrayTek VigorSwitch family is essential for creating a secure network architecture. Combined with the Layer 2+ and Layer 3 security features of Vigor routers, organisations can develop a layered defence strategy that safeguards users, devices, and infrastructure at every point.
This article offers a practical guide to securing your LAN using the Layer 2 and Layer 2+ features available on DrayTek VigorSwitches.
Why LAN Security Matters More Than Ever
Modern networks are crowded and continuously changing, with unmanaged devices such as BYOD (Bring Your Own Device) laptops in educational and workplace settings, IoT sensors, printers, cameras, and guest devices. Each of these represents a possible vulnerability.
Common LAN-originated threats include:
- MAC flooding
- ARP spoofing
- Rogue DHCP servers
- Man-in-the-middle attacks
- Broadcast storms
- DoS attacks
- Misconfigured static IP devices
- Accidental or malicious network loops
These threats can spread rapidly and be deadly, but are mostly preventable thanks to the security features of DrayTek Layer 2 and Layer 2+ VigorSwitches, which segment network traffic and block typical LAN attacks.
How DrayTek VigorSwitches Safeguard Your Network
To create a highly resilient network, security needs to encompass both the access and distribution layers. The DrayTek VigorSwitch series offers Layer 2 and Layer 2+ models that include Layer 3 capabilities. These switches provide a full suite of security features to protect your internal network, effectively segment traffic, and reduce the risk of typical LAN-related threats.
We will discuss these available features and how they can safeguard your network.
1. Network Segmentation: VLANs & Access Control Lists (ACLs)
The initial step in LAN security involves stopping unrestricted “any-to-any” communication. Typically, devices on the same flat network can communicate freely, which could allow malware to move laterally if it compromises one endpoint. Below are some recommendations:
Virtual LANs (VLANs)
VigorSwitches allow you to segment your network into distinct virtual areas, like separate domains for Corporate Users, Guests, IoT devices, and IP Cameras.
- Layer 2 Isolation: Traffic between different VLANs is completely blocked at the switch level unless explicitly routed by an upstream router or a Layer 3 switch. For example, isolating different departments such as administration, sales support and warehouse within an organisation.
Access Control Lists (ACLs)
ACLs on a DrayTek VigorSwitch function as a switch-level firewall, allowing you to control which traffic is permitted between hosts, even within the same VLAN. They examine packets based on criteria such as source and destination IP addresses, MAC addresses, TCP/UDP ports, or specific switch ports.
- Use Case: You can create an ACL rule that allows a guest network to access the Internet but completely blocks it from trying to communicate with your internal server subnet
2. Mitigating Spoofing and Man-in-the-Middle (MitM) Attacks
Attackers on a local network often exploit core networking protocols such as DHCP and ARP, which inherently lack built-in authentication. DrayTek addresses these vulnerabilities with advanced Layer 2+ security mechanisms.
DHCP Snooping
In a standard network, if a user accidentally connects to a rogue DHCP server, it can cause IP conflicts and redirect victims to malicious gateways or DNS servers. The VigorSwitch not only detects but also blocks misconfigured or malicious IP hosts.
- The Solution: DHCP Snooping marks certain switch ports as “Trusted” (linked to your genuine DHCP server or router) and regards all others as “Untrusted.” When a malicious DHCP offer appears on an untrusted port, the VigorSwitch immediately blocks the packet, ensuring your network remains secure and properly configured.
Dynamic ARP Inspection (DAI)
ARP poisoning allows attackers to associate their MAC address with the IP address of a legitimate gateway or server, enabling eavesdropping.
- The Solution: DAI intercepts all ARP requests and responses on untrusted ports. It cross-references them against the secure database built by DHCP Snooping to verify that the IP-to-MAC binding is valid. Invalid packets are discarded immediately.
3. Strict Device & User Authentication
Ensuring that only authorised hardware and personnel can physically connect to your network ports is critical for corporate offices and public-facing environments. This is achieved in several ways, including:
IP Source Guard
This feature prevents IP address spoofing. It uses the DHCP Snooping binding table to ensure that traffic from a specific port matches the IP and MAC address assigned to that port. If a device attempts to manually configure a spoofed static IP to bypass restrictions, its traffic is blocked.
802.1X Port-Based Authentication
For enterprise-level control, VigorSwitches integrate with external RADIUS or TACACS+ servers via the 802.1X protocol. When a device connects to a port, it must present valid credentials or a digital certificate before the port opens and grants network access. Unauthenticated devices can be automatically redirected to an isolated “Guest” or “Quarantine” VLAN.
MAC-Based Authentication & Port Security
If 802.1X is too complex for certain legacy devices (such as network printers), you can lock down ports using MAC Address Filters or limit the maximum number of MAC addresses per port. If an unauthorised device is plugged in, the switch can automatically shut down the port and trigger an alert.
4. Preventing Network DoS and Loop-Induced Outages
Internal security goes beyond preventing data theft; it also includes maintaining network availability and resilience.
DoS (Denial of Service) Defense
Malicious actors or severe malware infections can flood a switch with traffic, overwhelming its CPU and causing network degradation. VigorSwitches feature dedicated DoS defence toggles designed to mitigate specific flood attacks, such as Land attacks, Blat attacks, SYN floods, and ICMP floods.
Storm Control
If a network card malfunctions or a loop occurs, it can trigger a broadcast or multicast “storm” that completely saturates network bandwidth. Storm control lets you set strict thresholds on the volume of broadcast/multicast traffic permitted per port, dropping excess packets before they cripple the LAN.
5. Seamless Router Integration: The Smart Action Plan
Securing a network becomes exponentially easier when your components communicate seamlessly. DrayTek routers (such as the Vigor2865 or Vigor3912) work hand-in-hand with VigorSwitches through Central Switch Management (CSM). This includes later-model DrayOS 5 routers, such as the Vigor2928 series, which have the Virtual Controller function for managing DrayTek VigorSwitches.
From the single dashboard of your DrayTek router, you can:
- Provision and push VLAN configurations directly to multiple switches.
- Monitor port status.
Conclusion: Build a Secure LAN from the Inside Out
By integrating a DrayTek router’s edge protection with the strong Layer 2/2+ security features of VigorSwitches, you build a secure internal infrastructure capable of containing, detecting, and deflecting internal threats before they impact your business operations.
DrayTek VigorSwitches are not just “dumb switches”; they’re intelligent security appliances that protect your LAN against threats your firewall can’t detect.
With:
- 802.1X & MAC authentication
- IP Source Guard
- DHCP Snooping
- Dynamic ARP Inspection
- Protected Ports
- ACLs
- Port Security
- Storm Control
- DoS Defence
- Loop Protection
- IP Conflict Prevention
You gain a comprehensive suite of Layer 2+ protections that stop attacks before they spread.
Combine this with the Layer 3 firewalling and segmentation features of Vigor routers to create a strong, modern defence-in-depth setup. It’s a perfect choice for small and medium-sized businesses, hospitality venues, educational institutions, retail stores, and enterprise edge networks.
More Information
DrayTek PoE Switches and Gigabit Switches Product Page:
DrayTek PoE Switches and Gigabit Switches
https://www.draytek.com.au/products/network-switches/
Knowledge Base Articles
How to use MAC VLAN on VigorSwitch?
https://www.draytek.com/support/knowledge-base/6059
Deploying VLANs by SWM and VigorSwitch
https://www.draytek.com/support/knowledge-base/5279
Videos
Securing the LAN with DrayTek VigorSwitches – Part 1
https://youtu.be/beCZc8KrXNk
Securing the LAN with DrayTek VigorSwitches – Part 2
https://youtu.be/d_Rm6h_pKWk
