Is there a point to have VLANs if each PC client can access them all?

Question

At work we have a config where VLAN 1 is the main network and VLAN 2 is the phone system. The workstations connect automatically to VLAN 1 but can also access the control panels of each phone through that same cable, which means that a direct connection to each phone can be made.

Now I've heard that VLANs are supposed to separate traffic to increase security. But what's the point if my computer can access them all and a virus attack, which is intelligent enough to infect both workstations and phones, can reach them all? If it's not a good setup, what kind of setup would be a) secure enough to separate both VLANs entirely and b) management of the phones through their control panel can still be done efficiently?

Also I've heard that using the default VLAN (untagged 1) is not recommended security-wise for the same reason as described above, as the whole main network would be accessible to an attack.

Answer 1

By themselves, VLANs do not offer any security. But you use them to implement layer 3 security.

Remember that VLANs are layer 2 concepts, while IP subnets are layer 3 concepts. In most cases, there is a one to one correspondence between them -- one IP subnet per VLAN and vice versa.

Typically, you would use a security control that operates at layer 3, such as an access list, to allow only specific networks or hosts to access the phones' control panels. You would apply the ACL at a layer 3 boundary (i.e. the default gateway for that subnet). In most networks, the layer 3 boundary is also the layer 2 boundary (VLAN interface, SVI, etc.).

So by separating your network into VLANs, you have also separated it into IP subnets, which allows you to apply access control lists on the VLAN interfaces. You can create an access control list and apply in on the VLAN 2 interface that only allows certain hosts to access the control panels.

On Cisco switches, VLAN 1 is used for management protocols, such as STP, CDP, and DTP. These can be exploited in some cases by an attacker so it's safer to keep user traffic off of it. Only you can determine if the risk is worth the effort.