2

I'm configuring a Cisco router C1111-8p using IOS XE 16.8 with 3 VLANs.

  • VLAN 1: native/management 192.168.0.0/24
  • VLAN 10 : 192.168.10.0/24
  • VLAN 20 : 192.168.20.0/24

I haven't set ACLs up yet but basically:

  • I'd like to block everything but 2ports from outside and these 2 ports will be connected to VLAN 10 only.
  • VLAN 10,20 can communicate to each other.
  • Management/Native VLAN 1: Nobody should be able to access it but the Wireless AP for eap-tls management and Radius server.

Questions:

  • Connected to VLAN10, either from SSID10 or the GigabitEthernet 0/1/2. Why can I manually define my IP as a VLAN1 or VLAN10's IP?
  • Why can I literally obtain legally a different VLAN/subnet's IP than the one I'm connected to?

Wanting inter-VLANs communication doesn't mean I want my device be able to obtain an IP from a different VLAN/subnet.

In that case, there is a huge security weakness because someone in my network can obtain a management IP.

My config:

# Setup ISP internet connection
configure terminal
interface GigabitEthernet 0/0/0
description WAN
ip address 219.*.*.* 255.255.255.252
ip nat outside
no shutdown
end
conf t
ip nat inside source list NAT interface GigabitEthernet0/0/0 overload
ip route 0.0.0.0 0.0.0.0 219.*.*.*
ip dns server
ip domain-lookup
ip name-server 221.110.33.164 221.110.33.132
end

# Set DHCP pools
configure terminal
service dhcp
# Native pool
ip dhcp pool vlanNativePool
network 192.168.0.0 255.255.255.0
default-router 192.168.0.1
exit
# VLAN 10 pool
ip dhcp pool vlan10Pool
network 192.168.10.0 255.255.255.0
default-router 192.168.10.1
dns-server 221.110.33.164 221.110.33.132
# VLAN 20 pool
ip dhcp pool vlan20Pool
network 192.168.20.0 255.255.255.0
default-router 192.168.20.1
dns-server 221.110.33.164 221.110.33.132
end

#NAT
configure terminal
ip access-list standard NAT
permit 192.168.10.0 0.0.0.255
permit 192.168.20.0 0.0.0.255
permit 192.168.0.0 0.0.0.255
end

#Setup the trunk port between the switch and the WAP
configure terminal
interface GigabitEthernet 0/1/0
switchport mode trunk
switchport trunk native vlan 1
switchport trunk allowed vlan add 1,10,20
switchport nonegotiate
no shutdown
end

#Setup the port VLAN 1 native for the Radius/squid server
configure terminal
interface GigabitEthernet 0/1/6
switchport mode access
switchport access vlan 1
no shutdown
exit
#Setup the port VLAN 1 for management
configure terminal
interface GigabitEthernet 0/1/7
switchport mode access
switchport access vlan 1
no shutdown
end

# Setup the switch port for direct VLAN access
configure terminal
interface GigabitEthernet 0/1/2
switchport mode access
switchport access vlan 10
no shutdown
exit
interface GigabitEthernet 0/1/3
switchport mode access
switchport access vlan 20
no shutdown
exit

# Configure VLANs
ip routing
configure terminal
# VLAN 1 DEFAULT NATIVE
vlan 1
interface vlan 1
ip address 192.168.0.1 255.255.255.0
ip nat inside
exit
# VLAN 10
vlan 10
no shutdown
interface vlan 10
ip address 192.168.10.1 255.255.255.0
ip nat inside
no shutdown
exit
# VLAN 20
vlan 20
no shutdown
interface vlan 20
ip address 192.168.20.1 255.255.255.0
ip nat inside
no shutdown
end
Improve this question
8
  • i am not clear what you are asking? are you expecting to do intervlan Routing? between vlans?
    – infra
    May 13, 2019 at 7:40
  • I'm expecting that a computer connected to a switch port VLAN10 can't obtain a VLAN1's ip if it sets it up manually in his OS' settings.
    – Alexis
    May 13, 2019 at 7:41
  • do you configure dhcp relay agent?
    – infra
    May 13, 2019 at 8:10
  • I don't think so, my config is written in my question.
    – Alexis
    May 13, 2019 at 8:58
  • cisco.com/c/en/us/td/docs/interfaces_modules/services_modules/… you can see configurations
    – infra
    May 13, 2019 at 9:08

1 Answer 1

Reset to default
4

Unless you limit the administrative privileges on a host, you cannot prevent a user/admin to set any local IP address they like.

Usually, manually configuring an IP address from another VLAN/subnet renders a host deaf and dumb since no other node in its actual VLAN uses that IP subnet. Using an IP address from a specific subnet doesn't make the host a member of the required VLAN.

Using DHCP, the server won't assign any address from another subnet. Some switches support enforcing DHCP configuration by using strict IP/MAC binding with DHCP snooping - a node cannot use any other IP address than the one assigned by DHCP.

Basically, IP subnet are mapped to VLANs and you cannot simply choose a VLAN by changing your IP address.

Entering a specific VLAN other than your native VLAN (=the untagged VLAN on your switch port) requires the host to tag frames and the switch to accept those frames. Common best practice is to not accept tagged frames on a host port (standard for an access port on Cisco equipment).

Improve this answer
2
  • 1
    Usually, manually configuring an IP address from another VLAN/subnet renders a host deaf and dumb... True, in the case where proxy ARP is disabled. However depending on platform and software version proxy ARP may be enabled by default and allow this traffic to leak.
    – YLearn
    May 13, 2019 at 19:30
  • That's true, I tried to ping other VLANs and internet, I couldn't. Actually I access VLANs from wireless.
    – Alexis
    May 14, 2019 at 5:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.