5.4 VLAN Security Explained
Key Concepts of VLAN Security
VLAN (Virtual Local Area Network) security is crucial for maintaining network integrity and preventing unauthorized access. Key concepts include:
- VLAN Tagging: Ensuring that only properly tagged traffic is allowed on VLAN interfaces.
- Access Control Lists (ACLs): Filtering traffic based on predefined rules.
- Port Security: Limiting the number of MAC addresses allowed on a port.
- Dynamic Trunking Protocol (DTP) Security: Preventing unauthorized trunking.
- VLAN Hopping Prevention: Preventing attacks that exploit VLAN misconfigurations.
VLAN Tagging
VLAN tagging ensures that only traffic with the correct VLAN tag is allowed on a VLAN interface. This prevents unauthorized devices from sending traffic to unintended VLANs. Proper tagging is enforced through strict configuration of trunk and access ports.
Example: In a corporate network, all traffic destined for the HR VLAN (VLAN 10) must be tagged with VLAN ID 10. Any untagged or incorrectly tagged traffic is dropped, ensuring that only authorized devices can communicate within the HR VLAN.
Access Control Lists (ACLs)
ACLs are used to filter traffic based on predefined rules. They can be applied to VLAN interfaces to control which types of traffic are allowed or denied. ACLs enhance security by restricting access to sensitive VLANs and preventing malicious traffic.
Example: An ACL might be configured to allow only HTTP and HTTPS traffic on the Marketing VLAN (VLAN 20) while blocking all other types of traffic. This ensures that only web-related activities are permitted, reducing the risk of unauthorized access or attacks.
Port Security
Port security limits the number of MAC addresses allowed on a switch port. This prevents unauthorized devices from connecting to the network and helps mitigate MAC address spoofing attacks. Port security can be configured to allow a specific number of MAC addresses or to learn and lock the MAC addresses dynamically.
Example: A switch port connected to a server might be configured to allow only one MAC address. If a different MAC address attempts to connect, the port is automatically disabled, preventing unauthorized access to the server.
Dynamic Trunking Protocol (DTP) Security
DTP is a Cisco protocol used to negotiate trunk links between switches. However, it can be exploited by attackers to create unauthorized trunk links. To enhance security, DTP should be disabled on all non-trunking ports and trunk ports should be manually configured.
Example: In a network where trunking is not required on certain ports, disabling DTP prevents attackers from negotiating trunk links and potentially gaining access to multiple VLANs through a single compromised port.
VLAN Hopping Prevention
VLAN hopping is an attack where an unauthorized device gains access to multiple VLANs by exploiting misconfigurations. Prevention techniques include disabling DTP, configuring trunk ports correctly, and using 802.1Q tagging. Additionally, ensuring that all access ports are configured as access ports and not as trunk ports helps prevent VLAN hopping.
Example: A network administrator ensures that all access ports are configured as access ports and not as trunk ports. This prevents an attacker from connecting a device to an access port and gaining access to multiple VLANs through VLAN hopping attacks.