Implementing VLAN

Ali Mohammed (Msc in CS & Networking,

Presentation_ID © 2008 Cisco Systems, Inc. All rights reserved. Cisco Confidential 1
 Objectives
 Explain the purpose of VLAN in a switched network
 Analyze how a switch forwards frames based VLAN configuration in a multi-
switched environment
 Configure a switch port to be assigned to a VLAN based on requirements
 Configure a trunk port on a LAN switch
 Configure Dynamic Trunk Protocol (DTP)
 Troubleshoot VLAN and trunk configurations in a switched network
 Configure security features to mitigate attacks in a VLAN-segmented
environment
 Explain security best practices for a VLAN-segmented environment

Presentation_ID © 2008 Cisco Systems, Inc. All rights reserved. Cisco Confidential 2
 VLAN Definitions
 VLAN (virtual LAN) is a logical partition of a layer 2 network
 Multiple partition can be created, allowing for multiple VLANs to
co-exist
 Each VLAN is a broadcast domain, usually with its own IP
network
 VLANS are mutually isolated and packets can only pass between
them through a router
 The partitioning of the layer 2 network takes inside a layer 2
device, usually a switch.
 The hosts grouped within a VLAN are unaware of the VLAN’s
existence

Presentation_ID © 2008 Cisco Systems, Inc. All rights reserved. Cisco Confidential 3
 VLAN Definitions

Presentation_ID © 2008 Cisco Systems, Inc. All rights reserved. Cisco Confidential 4
 Benefits of VLANs
 Security
 Cost reduction
 Better performance
 Shrink broadcast domains
 Improved IT staff efficiency

Presentation_ID © 2008 Cisco Systems, Inc. All rights reserved. Cisco Confidential 5
 Types of VLANs

Presentation_ID © 2008 Cisco Systems, Inc. All rights reserved. Cisco Confidential 6
 VLANs in a Multi-Switched Environment
VLAN Trunks
 A VLAN trunk carries more than one VLAN
 Usually established between switches so same-VLAN
devices can communicate even if physically connected to
different switches
 A VLAN trunk is not associated to any VLANs. Neither is
the trunk ports used to establish the trunk link
 Cisco IOS supports IEEE 802.1q, a popular VLAN trunk
protocol

Presentation_ID © 2008 Cisco Systems, Inc. All rights reserved. Cisco Confidential 7
 VLANs in a Multi-Switched Environment
VLAN Trunks

Presentation_ID © 2008 Cisco Systems, Inc. All rights reserved. Cisco Confidential 8
 VLANs in a Multi-Switched Environment
Controlling Broadcast Domains with VLANs
 VLANs can be used to limit the reach of broadcast frames
 A VLAN is a broadcast domain of its own
 Therefore, a broadcast frame sent by a device in a specific
VLAN is forwarded within that VLAN only.
 This help controlling the reach of broadcast frames and their
impact in the network
 Unicast and multicast frames are forwarded within the
originating VLAN as well

Presentation_ID © 2008 Cisco Systems, Inc. All rights reserved. Cisco Confidential 9
 Tagging Ethernet Frames for VLAN Identification
 Frame tagging is used to properly transmit multiple VLAN frames
through a trunk link
 Switches will tag frames to identify the VLAN they belong.
Different tagging protocols exist, with IEEE 802.1q being a very
popular one
 The protocol defines the structure of the tagging header added to
the frame
 Switches will add VLAN tags to the frames before placing them
into trunk links and remove the tags before forwarding frames
through non-trunk ports
 Once properly tagged, the frames can transverse any number of
switches via trunk links and still be forward within the correct
VLAN at the destination

Presentation_ID © 2008 Cisco Systems, Inc. All rights reserved. Cisco Confidential 10
 VLAN Assignment
Creating a VLAN

Presentation_ID © 2008 Cisco Systems, Inc. All rights reserved. Cisco Confidential 11
 VLAN Assignment
Assigning Ports To VLANs

Presentation_ID © 2008 Cisco Systems, Inc. All rights reserved. Cisco Confidential 12
 VLAN Assignment
Changing VLAN Port Membership

Presentation_ID © 2008 Cisco Systems, Inc. All rights reserved. Cisco Confidential 13
 VLAN Assignment
Changing VLAN Port Membership

Presentation_ID © 2008 Cisco Systems, Inc. All rights reserved. Cisco Confidential 14
 VLAN Assignment
Deleting VLANs

Presentation_ID © 2008 Cisco Systems, Inc. All rights reserved. Cisco Confidential 15
 VLAN Assignment
Verifying VLAN Information

Presentation_ID © 2008 Cisco Systems, Inc. All rights reserved. Cisco Confidential 16
 VLAN Assignment
Verifying VLAN Information

Presentation_ID © 2008 Cisco Systems, Inc. All rights reserved. Cisco Confidential 17
 VLAN Assignment
Configuring IEEE 802.1q Trunk Links

Presentation_ID © 2008 Cisco Systems, Inc. All rights reserved. Cisco Confidential 18
 VLAN Assignment
Resetting the Trunk To Default State

Presentation_ID © 2008 Cisco Systems, Inc. All rights reserved. Cisco Confidential 19
 VLAN Assignment
Resetting the Trunk To Default State

Presentation_ID © 2008 Cisco Systems, Inc. All rights reserved. Cisco Confidential 20
 VLAN Assignment
Verifying Trunk Configuration

Presentation_ID © 2008 Cisco Systems, Inc. All rights reserved. Cisco Confidential 21
 Dynamic Trunking Protocol
Introduction to DTP
 Switch ports can be manually configured to form trunks
 Switch ports can also be configured to negotiate and
establish a trunk link with a connected peer
 Dynamic Trunking Protocol (DTP) is a protocol to
manage trunk negotiation
 DTP is a Cisco proprietary protocol and is enabled by
default in Cisco Catalyst 2960 and 3560 switches
 If the port on the neighbor switch is configured in a
trunk mode that supports DTP, it manages the
negotiation
 The default DTP configuration for Cisco Catalyst 2960
and 3560 switches is dynamic auto
Presentation_ID © 2008 Cisco Systems, Inc. All rights reserved. Cisco Confidential 22
 Dynamic Trunking Protocol
Negotiated Interface Modes
 Cisco Catalyst 2960 and 3560 support the following
trunk modes:
• switchport mode dynamic auto
• switchport mode dynamic desirable
• switchport mode trunk
• switchport nonegotiate

Presentation_ID © 2008 Cisco Systems, Inc. All rights reserved. Cisco Confidential 23
 Troubleshooting VLANs and Trunks
Addressing Issues with VLAN
 It is very common practice to associate a VLAN with a
IP network
 Since different IP networks only communicate through a
router, all devices within a VLAN must be part of the
same IP network in order to communicate
 In the picture below, PC1 can’t communicate to the
server because it has a wrong IP address configured

Presentation_ID © 2008 Cisco Systems, Inc. All rights reserved. Cisco Confidential 24
 Troubleshooting VLANs and Trunks
Missing VLANs
 If all IP addresses mismatch have been solved but
device still can’t connect, check if the VLAN exists in
the switch.

Presentation_ID © 2008 Cisco Systems, Inc. All rights reserved. Cisco Confidential 25
 Troubleshooting VLANs and Trunks
Introduction to Troubleshooting Trunks

Presentation_ID © 2008 Cisco Systems, Inc. All rights reserved. Cisco Confidential 26
 Troubleshooting VLANs and Trunks
Common Problems With Trunks
 Trunking issues are usually associated with incorrect
configurations.
 The most common type of trunk configuration errors
are:
1. Native VLAN mismatches
2. Trunk mode mismatches
3. Allowed VLANs on trunks
 If a trunk problem is detected, the best practice
guidelines recommend to troubleshoot in the order
shown above.

Presentation_ID © 2008 Cisco Systems, Inc. All rights reserved. Cisco Confidential 27
 Troubleshooting VLANs and Trunks
Trunk Mode Mismatches
 If a port on a trunk link is configured with a trunk mode
that is incompatible with the neighboring trunk port, a
trunk link fails to form between the two switches
 Check the status of the trunk ports on the switches
using the show interfaces trunk command
 To fix the problem, configure the interfaces with proper
trunk modes.

Presentation_ID © 2008 Cisco Systems, Inc. All rights reserved. Cisco Confidential 28
 Troubleshooting VLANs and Trunks
Incorrect VLAN List
 VLANs must be allowed in the trunk before their frames
can be transmitted across the link
 Use the switchport trunk allowed vlan command to
specifuy which VLANs are allowed in a trunk link
 To ensure the correct VLANs are permitted in a trunk,
used the show interfaces trunk command

Presentation_ID © 2008 Cisco Systems, Inc. All rights reserved. Cisco Confidential 29
 Attacks on VLANs
Switch spoofing Attack
 There are a number of different types of VLAN attacks
in modern switched networks. VLAN hopping is one
them.
 The default configuration of the switch port is dynamic
auto
 By configuring a host to act as a switch and form a
trunk, an attacker could gain access to any VLAN in the
network.
 Because the attacker is now able to access other
VLANs, this is called a VLAN hopping attack
 To prevent a basic switch spoofing attack, turn off
trunking on all ports, except the ones that specifically
require trunking
Presentation_ID © 2008 Cisco Systems, Inc. All rights reserved. Cisco Confidential 30
 Attacks on VLANs
Double-Tagging Attack
 The double-tagging attack takes advantage of the way
that hardware on most switches de-encapsulate 802.1Q
tags
 Most switches perform only one level of 802.1Q de-
encapsulation, allowing an attacker to embed a second,
unauthorized attack header in the frame
 After removing the first and legit 802.1Q header, the
switch forwards the frame to the VLAN specified in the
unauthorized 802.1Q header
 The best approach to mitigating double-tagging attacks
is to ensure that the native VLAN of the trunk ports is
different from the VLAN of any user ports

Presentation_ID © 2008 Cisco Systems, Inc. All rights reserved. Cisco Confidential 31
 Attacks on VLANs
Double-Tagging Attack

Presentation_ID © 2008 Cisco Systems, Inc. All rights reserved. Cisco Confidential 32
 Attacks on VLANs
PVLAN Edge
 Private VLAN (PVLAN) Edge
feature, also known as protected
ports, ensures that there is no
exchange of unicast, broadcast,
or multicast traffic between
protected ports on the switch
 Local relevancy only
 A protected port only exchanges
traffic with un-protected ports
 A protected port will not
exchange traffic with another
protected port

Presentation_ID © 2008 Cisco Systems, Inc. All rights reserved. Cisco Confidential 33
 Design Best Practices For VLANs
VLAN Design Guideline
 Move all ports from VLAN1 and assign them to a not-
in-use VLAN
 Shut down all unused switch ports
 Separate management and user data traffic
 Change the management VLAN to a VLAN other than
VLAN1. The same goes to the native VLAN
 Make sure that only devices in the management VLAN
can connect to the switches
 The switch should only accept SSH connections
 Disable autonegotiation on trunk ports
 Do not use the auto or desirable switch port modes

Presentation_ID © 2008 Cisco Systems, Inc. All rights reserved. Cisco Confidential 34
Presentation_ID © 2008 Cisco Systems, Inc. All rights reserved. Cisco Confidential 35