2

if i have 3 vlans say, 10,20 ,30

if i don't assign vlan allowed to trunk port , what are the security risks i could face if i am using default vlan allowed range

what are the benefits of VLAN allowed feature

Thanks in advance :)

  • 1
    Without trunk allowed VLAN, the switchport will always forward all locally layer 2 created VLANs on a trunk. – user36472 Nov 9 '18 at 12:41
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide and accept your own answer. – Ron Maupin Dec 25 '18 at 9:56
  • How to accept answer – PDHide Dec 26 '18 at 21:03
  • Click the check mark to the left of the answer you want to accept. You get two points for accepting an answer. It looks like you have previously accepted an answer. – Ron Maupin Dec 26 '18 at 21:06
5

Generally, you'll want to secure VLAN membership for all ports that you don't control on both link ends. If a trunk port - or rather the link partner - can simply join any VLAN they want then an attacker can very easily penetrate each VLAN. This is called VLAN hopping.

You can leave trunk ports unsecured when the link is entirely within your control - your switches, your routers, your hosts, and these links are physically secured on both ends, ie. in locked closets or cabinets. This may simplify your administration, depending on how you do things.

However, if VLAN separation is part of your security concept it's utterly foolish to leave it to "someone else" to choose the VLANs they connect to.

3

You would allow things like unknown unicast, broadcast, and multicast frames for VLANs not used on the switch to get to the switch, which will unnecessarily waste bandwidth on the trunk that may otherwise be needed for the VLANs actually used on the switch.

Also, when there is a broadcast storm on a VLAN not used on the switch, you could overload the switch. Blocking unused VLANs could keep the switch functional and isolate a broadcast storm or STP failure.


The best practices are to only allow a VLAN on a single access switch. You can have multiple VLANs on an access switch, but they do not go to any other access switch, and an access switch only connects to distribution switches, not any other access switch. You also do not allow access interfaces on the distribution switch(es). This will prevent most layer-2 problems on the network, and isolate any to a single access switch.

Taking that even further, you can now run layer-3 between the distribution and access to further isolate any layer-2 problems.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.