if i have 3 vlans say, 10,20 ,30
if i don't assign vlan allowed to trunk port , what are the security risks i could face if i am using default vlan allowed range
what are the benefits of VLAN allowed feature
Thanks in advance :)
Network Engineering Stack Exchange is a question and answer site for network engineers. It only takes a minute to sign up.Sign up to join this community
Generally, you'll want to secure VLAN membership for all ports that you don't control on both link ends. If a trunk port - or rather the link partner - can simply join any VLAN they want then an attacker can very easily penetrate each VLAN. This is called VLAN hopping.
You can leave trunk ports unsecured when the link is entirely within your control - your switches, your routers, your hosts, and these links are physically secured on both ends, ie. in locked closets or cabinets. This may simplify your administration, depending on how you do things.
However, if VLAN separation is part of your security concept it's utterly foolish to leave it to "someone else" to choose the VLANs they connect to.
You would allow things like unknown unicast, broadcast, and multicast frames for VLANs not used on the switch to get to the switch, which will unnecessarily waste bandwidth on the trunk that may otherwise be needed for the VLANs actually used on the switch.
Also, when there is a broadcast storm on a VLAN not used on the switch, you could overload the switch. Blocking unused VLANs could keep the switch functional and isolate a broadcast storm or STP failure.
The best practices are to only allow a VLAN on a single access switch. You can have multiple VLANs on an access switch, but they do not go to any other access switch, and an access switch only connects to distribution switches, not any other access switch. You also do not allow access interfaces on the distribution switch(es). This will prevent most layer-2 problems on the network, and isolate any to a single access switch.
Taking that even further, you can now run layer-3 between the distribution and access to further isolate any layer-2 problems.