Home / server / Questions / 243118
Accepted
CyberOptic
Asked: 2011-03-05 01:02:25 +0800 CST

New Cisco Catalyst switches and ISL Trunks?

  • 772

newer Catalysts do not offer the ISL trunk mode anymore. Now I fear VLAN-hopping/encapsulation attacks when using VLANs for WAN-isolation.

  1. What can I do to prevent such attacks?
  2. Can I mix ISL and 802.1Q trunk connections?
  3. Anything else I have to consider?

Thanks

edit:

Is VLAN-hopping possible if all hosts are connected to "Static Access"-configured switchports and the 802.1Q-trunks are only between the Cisco switches?

vlan wide-area-network security cisco

3 Answers

  1. You should be relatively safe by using the following configuration on host facing interfaces:

    switchport mode access
switchport access vlan <vlan>

    This will disable DTP (dynamic trunking protocol) on the port and help prevent VLAN hopping attacks.

    Also, it is a good practice to enumerate the allowed VLANs on your trunk interfaces with the following configuration:

    switchport trunk allowed vlan <vlan list>

    A good reference for layer 2 security best practices can be found here:

    SAFE LAYER 2 SECURITY IN-DEPTH — VERSION 2 (PDF)

    • 0

  2. If a switch port is forced to ACCESS mode (switchport nonegotiate, switchport mode access)and assigned to a specific VLAN (switchport access vlan X), this is a completely safe setup; should the connected host(s) send any tagged frame, it would be discarded because no trunking would be possible on that port.

    If trunking is only used between the switches and you have good physical security, there is no way for any computer to access any VLAN other than its own.

    • 0
  3. Best Answer

    After quite some research I've found the answer:

    http://www.sans.org/security-resources/idfaq/vlan.php

    In a default configuration it is possible to inject 802.1q frames into non-trunk ports on a switch and have these frames delivered to the destination.

    It is possible to get 802.1q frames to hop from one VLAN to another if the frames are injected into a switch port belonging to the native VLAN of the trunk port. [..]

    Thus I have to make sure that the access-mode VLANs are not using the native VLAN configured on the trunk:

    [...] by changing the native VLAN of the trunk port the VLAN hopping could be eliminated. This was tested and was found to be true.

    • 0