Are there any security advantages to activating VLAN tagging?

Question

I understand the concepts of generating a VLAN. However, on a small, closed, sophisticated network, are there any security advantages to activating VLAN tagging?

Answer 1

The security part comes from using VLANs. Users and devices on one VLAN cannot communicate with users and devices on another VLAN, except through a router. This gives you the opportunity to place restrictions (firewall, ACLs, etc.) on the VLAN-to-VLAN communication.

VLAN tags are used on a trunk, where traffic from multiple VLANs travels, in order to tag the frames so that switches know which frames belongs to which VLAN. Most end-devices don't understand VLAN tags on frames, and tagging frames to an end-device will usually result in the frames being dropped. This part isn't really about security, except where it helps keep the traffic separate on trunks where there is traffic from multiple VLANs.

Answer 2

By themselves, VLANs do not have any security advantages. But using VLANs, as @ronmaupin hints at, allows you to place access control lists to restrict traffic flowing from one VLAN to another. So, for example, you can restrict users on a insecure VLAN from reaching devices on a more secure VLAN.

You would use VLAN tagging if you have more than one VLAN on a physical port.

Answer 3

This is more about forming layer 2 boundaries for frames and segmenting your traffic than security, it does help to some degree because without layer 3 ip routing the traffic from each vlan only knows about vlans allowed on trunks connected to that host...trunks carry multiple vlans and connect layer 2 environments with the ability to allow specific vlans on each trunk or allow all ( bad idea).

When a layer three Virtual routed interface is added to a vlan then it can be connected to other layer three vlans spanning subnet and network boundaries. This of course requires a router or layer three switch along with a routing protocol to dictate the rules of traffic flow connectivity etc.....

Answer 4

Yes.

Devices on the same L2 domain can be vulnerable to each other. ARP spoofing, Mac spoofing or MAC flooding techniques can be used to intercept traffic. Protocols other than IP may be running and not as well protected as IP. Some software firewalls default to trusting devices on the local subnet. Some switches have features to mitigate these issues but they are bolted on as afterthoughts, in some cases you may find your switches have protection features for IPv4 but no corresponding features for IPv6. It is also difficult to firewall between devices on the same L2 domain.

Splitting up the L2 domain allows you to reduce your exposure to L2 weaknesses and allow you to put firewalls in place to control communications between different parts of your network.

You could do this splitting by building physically seperate networks but that is expensive and error-prone. VLANs with tagged trunks allow you to realise much of the security benefit of seperate networks without the high costs.

Answer 5

None. Security vulnerabilities are unaffected by layer 3 hops; they are usually embedded in applications.