I've been presented with some odd "security conventions" in a large company I'm contracting with and am trying to get some perspectives on them.
I need to build a number of servers virtualization servers in a data center but have been told that I can not 1) relay any "layer 2" protocols outside of their origin network and 2) use native vlan on a trunked interface to a server.
So instead of enabling a bootp relay on the Cisco 6513 on a number of network segments I instead need to presumably build 3 or 4 DHCP servers and place them out close to the internet in each relevant vlan. Why would you ever deny relaying of DHCP? It's surely much more secure to keep a secure resilient DHCP server at the back of a network that various others dotted around the place in much more exposed locations. I really can't see any benefits here in the slightest.
As for not being allowed a native VLAN, This sounds like a convention whereby trunks on IOS devices should be configured to not leave VLAN 0 open as native by default on inter switch trunks (along with vtp etc.) accidentally exposing your network infrastructure to attack.
Does this policy seem familiar to anyone else? It certainly feels that some best practises have steadily warped over time to become just plain stupid.