4

I understand the concepts of generating a VLAN. However, on a small, closed, sophisticated network, are there any security advantages to activating VLAN tagging?

1

5 Answers 5

4

The security part comes from using VLANs. Users and devices on one VLAN cannot communicate with users and devices on another VLAN, except through a router. This gives you the opportunity to place restrictions (firewall, ACLs, etc.) on the VLAN-to-VLAN communication.

VLAN tags are used on a trunk, where traffic from multiple VLANs travels, in order to tag the frames so that switches know which frames belongs to which VLAN. Most end-devices don't understand VLAN tags on frames, and tagging frames to an end-device will usually result in the frames being dropped. This part isn't really about security, except where it helps keep the traffic separate on trunks where there is traffic from multiple VLANs.

2
  • Respectfully, this is wrong because no network security comes from VLAN segmentation itself. NGFW's can operate at layer 2 / transparent mode and stateful inspection / ACL's by themselves can be applied in the absence of a VLAN segmented switch. Sep 12, 2016 at 23:23
  • The question, "...are there any security advantages to activating VLAN tagging?" is directly, and correctly, answered by my answer.
    – Ron Maupin
    Sep 12, 2016 at 23:25
2

By themselves, VLANs do not have any security advantages. But using VLANs, as @ronmaupin hints at, allows you to place access control lists to restrict traffic flowing from one VLAN to another. So, for example, you can restrict users on a insecure VLAN from reaching devices on a more secure VLAN.

You would use VLAN tagging if you have more than one VLAN on a physical port.

1
  • Some devices such as Brocade use 'tagging' as the means to configuring basic VLAN for a physical port, i.e. you enter VLAN mode then apply physical ports to it (opposite of Cisco). This may be where the OP is coming from,.. Sep 12, 2016 at 23:25
1

This is more about forming layer 2 boundaries for frames and segmenting your traffic than security, it does help to some degree because without layer 3 ip routing the traffic from each vlan only knows about vlans allowed on trunks connected to that host...trunks carry multiple vlans and connect layer 2 environments with the ability to allow specific vlans on each trunk or allow all ( bad idea).

When a layer three Virtual routed interface is added to a vlan then it can be connected to other layer three vlans spanning subnet and network boundaries. This of course requires a router or layer three switch along with a routing protocol to dictate the rules of traffic flow connectivity etc.....

0

Yes.

Devices on the same L2 domain can be vulnerable to each other. ARP spoofing, Mac spoofing or MAC flooding techniques can be used to intercept traffic. Protocols other than IP may be running and not as well protected as IP. Some software firewalls default to trusting devices on the local subnet. Some switches have features to mitigate these issues but they are bolted on as afterthoughts, in some cases you may find your switches have protection features for IPv4 but no corresponding features for IPv6. It is also difficult to firewall between devices on the same L2 domain.

Splitting up the L2 domain allows you to reduce your exposure to L2 weaknesses and allow you to put firewalls in place to control communications between different parts of your network.

You could do this splitting by building physically seperate networks but that is expensive and error-prone. VLANs with tagged trunks allow you to realise much of the security benefit of seperate networks without the high costs.

-1

None. Security vulnerabilities are unaffected by layer 3 hops; they are usually embedded in applications.

2
  • What security does VLAN segmentation provide? I am genuinely interested in hearing and learning.. Sep 12, 2016 at 23:17
  • The question is not about VLAN segmentation security benefits. It is about the security benefits of VLAN tags. That is a very different question. In my answer, I explained that VLAN tags have nothing to do with security. Security should be layered, and not allowing two devices on the same switch communicate because they are on different VLANs is one legitimate layer of security.
    – Ron Maupin
    Sep 13, 2016 at 18:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.