newer Catalysts do not offer the ISL trunk mode anymore. Now I fear VLAN-hopping/encapsulation attacks when using VLANs for WAN-isolation.

  1. What can I do to prevent such attacks?
  2. Can I mix ISL and 802.1Q trunk connections?
  3. Anything else I have to consider?



Is VLAN-hopping possible if all hosts are connected to "Static Access"-configured switchports and the 802.1Q-trunks are only between the Cisco switches?

  • 1
    Why would .1q be any less secure than ISL? I'm not sure your question is answerable as it stands, there's a lack of clarity. – Chopper3 Mar 4 '11 at 11:18
  • As I understand Ciscos "Virtual LAN Security Best Practices", VLAN-hopping is only possible in 802.1Q environments? – CyberOptic Mar 4 '11 at 11:45

You should be relatively safe by using the following configuration on host facing interfaces:

switchport mode access
switchport access vlan <vlan>

This will disable DTP (dynamic trunking protocol) on the port and help prevent VLAN hopping attacks.

Also, it is a good practice to enumerate the allowed VLANs on your trunk interfaces with the following configuration:

switchport trunk allowed vlan <vlan list>

A good reference for layer 2 security best practices can be found here:



If a switch port is forced to ACCESS mode (switchport nonegotiate, switchport mode access)and assigned to a specific VLAN (switchport access vlan X), this is a completely safe setup; should the connected host(s) send any tagged frame, it would be discarded because no trunking would be possible on that port.

If trunking is only used between the switches and you have good physical security, there is no way for any computer to access any VLAN other than its own.


After quite some research I've found the answer:


In a default configuration it is possible to inject 802.1q frames into non-trunk ports on a switch and have these frames delivered to the destination.

It is possible to get 802.1q frames to hop from one VLAN to another if the frames are injected into a switch port belonging to the native VLAN of the trunk port. [..]

Thus I have to make sure that the access-mode VLANs are not using the native VLAN configured on the trunk:

[...] by changing the native VLAN of the trunk port the VLAN hopping could be eliminated. This was tested and was found to be true.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.