Splitting a switch with VLANS. Is it secure?

Question

I'm trying to get my head around VLAN terms tagged, untagged, and PVID.

From my understanding so far:

• every port on a switch can be mapped to a particular VLAN.
• when a packet (assigned to a VLAN) enters the switch it will leave all other ports which are assigned to the same VLAN as the packet. (Incorrect, see answer below)
• When the packet leaves it can either leave untagged, or be tagged, and this is determined per port depending if the port is configured to be tagged for that VLAN, or untagged for that VLAN.
• If an untagged packet enters the switch on a port, it is automatically tagged with the VLAN which corresponds to the PVID of the port it entered on.
• If a tagged packet enters the switch on a port, it will continue into the switch with the VLAN it was tagged as. (Incorrect, see answer below)

Is my last point correct?

---

I would like to split my netgear FSM726 switch into 2 isolated switches using VLANs.

I was going to therefore have 2 VLANS with ID 1 and 2.

For the first half of the switch the PVID would be set to 1, and the ports would be set to untagged on VLAN1, with the rest of the ports omitted.

For the second half of the switch the PVID would be set to 2, and the ports would be set to untagged on VLAN2, with the rest of the ports omitted.

I think this would work but couldn't someone plugged into the first half of the switch send a packet tagged with VLAN ID 2, and therefore have it exit on the second half of the switch?

Answer 1

When a tagged frame (it's Layer 2 we are talking about so we are dealing with frames, not packets) enter the switch, it will be verified against the authorized VLANs for the port.

If the VLAN2 is not authorized on the port, the frame will be dropped.

So yes, if properly configured, it's secure.

Note that as a best practice, you shouldn't use VLAN1, and by default netgear use VLAN2 as the voice vlan (you can still use it but it may be easier to choose another one)

Also the statement

"when a packet (assigned to a VLAN) enters the switch it will leave all other ports which are assigned to the same VLAN as the packet."

is incorrect. The switch first determine the destination port (based on the destination mac) and the send the frame out of this port, tagged or untagged depending on the port configuration for this vlan.

(only if this is a broadcast or the switch doesn't know the destination mac address will it be flooded to all ports pertaining to this vlan)

Answer 2

For completeness, VLANs can be insecure if attackers deploy VLAN hopping and certain conditions are met (from https://en.wikipedia.org/wiki/VLAN_hopping)

Switch spoofing

In a switch spoofing attack, an attacking host imitates a trunking switch by speaking the tagging and trunking protocols (e.g. Multiple VLAN Registration Protocol, IEEE 802.1Q, Dynamic Trunking Protocol) used in maintaining a VLAN. Traffic for multiple VLANs is then accessible to the attacking host.

Mitigation

Switch spoofing can only be exploited when interfaces are set to negotiate a trunk. To prevent this attack on Cisco IOS, use one of the following methods:

1. Ensure that ports are not set to negotiate trunks automatically by disabling DTP:

Switch(config-if)# switchport nonegotiate

2. Ensure that ports that are not meant to be trunks are explicitly configured as access ports

Switch(config-if)# switchport mode access Double tagging

In a double tagging attack, an attacking host connected on a 802.1q interface prepends two VLAN tags to packets that it transmits. The packet (which corresponds to the VLAN that the attacker is really a member of) is forwarded without the first tag, because it is the native VLAN. The second (false) tag is then visible to the second switch that the packet encounters. This false VLAN tag indicates that the packet is destined for a target host on a second switch. The packet is then sent to the target host as though it originated on the target VLAN bypassing the network mechanisms that logically isolate VLANs from one another. However, this attack allows to send packets toward the second switch, but possible answers are not forwarded to the attacking host.

Mitigation

Double Tagging can only be exploited when switches use "Native VLANs".[2] Ports with a specific access VLAN (the native VLAN) don't apply a VLAN tag when sending frames, allowing the attacker's fake VLAN tag to be read by the next switch.

Double Tagging can be mitigated by either one of the following actions (Incl. IOS example):

Simply do not put any hosts on VLAN 1 (The default VLAN). i.e., assign an access VLAN other than VLAN 1 to every access port

Switch(config-if)# switchport access vlan 2

Change the native VLAN on all trunk ports to an unused VLAN ID.

Switch(config-if)# switchport trunk native vlan 999

Explicit tagging of the native VLAN on all trunk ports. Must be configured on all switches in network autonomy.

Switch(config)# vlan dot1q tag native

Example

As an example of a double tagging attack, consider a secure web server on a VLAN called VLAN2. Hosts on VLAN2 are allowed access to the web server; hosts from outside VLAN2 are blocked by layer 3 filters. An attacking host on a separate VLAN, called VLAN1(Native), creates a specially formed packet to attack the web server. It places a header tagging the packet as belonging to VLAN2 under the header tagging the packet as belonging to VLAN1. When the packet is sent, the switch sees the default VLAN1 header and removes it and forwards the packet. The next switch sees the VLAN2 header and puts the packet in VLAN2. The packet thus arrives at the target server as though it was sent from another host on VLAN2, ignoring any layer 3 filtering that might be in place.