2

What are the security implications when using subnets as opposed to VLANs for segmenting an enterprise network? We have strict security requirements surrounding the data we handle and need to ensure that machines allowed to access these data are locked down and isolated from the rest of the network.

I understand that conceptually, VLANs allow for OSI level 2 isolation whereas subnets allow for level 3 isolation by firewalling traffic based on port and source and destination IP. However, I'm unsure of what the practical implications of this is from a security standpoint. I have a few specific follow-up questions:

  1. Are there attacks (like ARP poisoning or MAC flooding) that can cause traffic to be diverted to or read by a malicious entity within a different subnet (even if the firewall would block that traffic normally) that wouldn't affect a system segmented by VLANs?
  2. Would traffic typical of data analysis tasks, such as between a machine and a cloud database, be readable by a malicious entity within an unauthorized subnet due to the entire networking being in the same broadcast domain?
  3. Are there any complications or security callouts with using a VPN to access a cloud environment in either setup?
  • Removed the off-topic request for recommendations. – Ron Maupin Jan 8 '18 at 19:35
2

Subnets are the IP stacks way of determining what hosts are "assumed to be on link". If an address is in the same subnet traffic will be sent directly, otherwise it will be sent to a router (by default).

VLANs are a method for splitting a physical Ethernet network into multiple virtual Ethernet networks.

If you put hosts with different subnets on the same unpartitioned Ethernet network then IPv4 unicast traffic (and possibly IPv6 global unicast traffic depending on how you set up IPv6 routing on the clients) will by default flow via the router where it can be firewalled. However.

  1. A malicious user of a host on one subnet can easilly add himself a secondary IP on the other subnet and use it to talk to the machines on that subnet directly bypassing your router/firewall.
  2. Broadcast traffic, multicast traffic, IPv6 link-local traffic, non-ip traffic and so-on can flow directly between the systems bypassing your router/firewall.
  3. Low level attacks like ARP poisioning, MAC flooding etc won't care what subnets the machines are supposed to be on.

If you want your L3 firewall to provide more than the illusion of seggregation then you need to split up the L2 network, either physically or virtually.

0

Under normal circumstances, you would use a separate layer-3 network for each layer-2 VLAN. You could then use layer-3 security policies (ACLs, firewall, etc.) between the layer-3 networks, and get the full layer-2 separation, also. Using multiple layer-3 networks on the same layer-2 LAN for IPv4 is rare, and you should really know what you are doing, and are doing it for a specific reason.

You do not provide enough information to properly answer your last two questions.

  • My overall line of questioning is more broad I think. What I'm curious about is when, from a security standpoint, would I want to segment the network using VLANs at layer 2 versus forgoing VLANs completely and segmenting the entire network using subnets? We're a small company-congestion and performance are not concerns at our scale however security is. – Thuy Guevarra Jan 8 '18 at 20:23
  • What information would you need to know to answer the second two questions? – Thuy Guevarra Jan 8 '18 at 20:25
  • What I am trying to explain is that VLAN and networks go hand-in-hand under normal circumstances. There are particular corner cases where you may have multiple networks on the same VLAN, but you don't even want to consider that unless you have a reason and really know what you are doing. We would need to have a good description of how the network is connected (ideally, a diagram), what the networks devices are, the particular network device models, a good understanding of the network flows and requirements, etc. There really are just too many variables in what you ask. – Ron Maupin Jan 8 '18 at 20:28
  • I see, what I'm specifically interested in knowing is how segmentation at layer-2 versus layer-3 impacts security. I understand there are many more variables to consider but this one is going to have the most impact on the decisions we make. Keep in mind, the options I'm considering are no VLANs and multiple networks versus multiple VLANs and one network per VLAN. – Thuy Guevarra Jan 8 '18 at 20:35
0

If you run separate IP subnets within a single layer-2 network, any client can switch the subnet or connect to multiple subnets simultaneously. Additionally, dynamically assigning IP addresses from multiple subnets can be challenging in a single L2 segment = broadcast domain.

For any security based on subnets (zones) you need layer-2 separation = separate VLANs and control over the communication in between.

L2 separation implies L3 separation. L3 separation doesn't necessarily imply L2 separation but to implement security zones you need VLAN separation.

0

I didn't see anyone else mention it but, not only are you separating the broadcast domains in utilizing VLANs, but you also add another layer of security/granularity as the VLANs are defined on the access layer port interfaces.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.