Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

newer Catalysts do not offer the ISL trunk mode anymore. Now I fear VLAN-hopping/encapsulation attacks when using VLANs for WAN-isolation.

  1. What can I do to prevent such attacks?
  2. Can I mix ISL and 802.1Q trunk connections?
  3. Anything else I have to consider?

Thanks

edit:

Is VLAN-hopping possible if all hosts are connected to "Static Access"-configured switchports and the 802.1Q-trunks are only between the Cisco switches?

share|improve this question
1  
Why would .1q be any less secure than ISL? I'm not sure your question is answerable as it stands, there's a lack of clarity. –  Chopper3 Mar 4 '11 at 11:18
    
As I understand Ciscos "Virtual LAN Security Best Practices", VLAN-hopping is only possible in 802.1Q environments? –  CyberOptic Mar 4 '11 at 11:45

3 Answers 3

You should be relatively safe by using the following configuration on host facing interfaces:

switchport mode access
switchport access vlan <vlan>

This will disable DTP (dynamic trunking protocol) on the port and help prevent VLAN hopping attacks.

Also, it is a good practice to enumerate the allowed VLANs on your trunk interfaces with the following configuration:

switchport trunk allowed vlan <vlan list>

A good reference for layer 2 security best practices can be found here:

SAFE LAYER 2 SECURITY IN-DEPTH — VERSION 2 (PDF)

share|improve this answer

If a switch port is forced to ACCESS mode (switchport nonegotiate, switchport mode access)and assigned to a specific VLAN (switchport access vlan X), this is a completely safe setup; should the connected host(s) send any tagged frame, it would be discarded because no trunking would be possible on that port.

If trunking is only used between the switches and you have good physical security, there is no way for any computer to access any VLAN other than its own.

share|improve this answer
up vote 0 down vote accepted

After quite some research I've found the answer:

http://www.sans.org/security-resources/idfaq/vlan.php

In a default configuration it is possible to inject 802.1q frames into non-trunk ports on a switch and have these frames delivered to the destination.

It is possible to get 802.1q frames to hop from one VLAN to another if the frames are injected into a switch port belonging to the native VLAN of the trunk port. [..]

Thus I have to make sure that the access-mode VLANs are not using the native VLAN configured on the trunk:

[...] by changing the native VLAN of the trunk port the VLAN hopping could be eliminated. This was tested and was found to be true.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.