4

Most VLAN articles I've read recommend avoid using VLAN1 for ports with untagged traffic (aka access ports). I've heard enough of this nonsense. Except for the reserved values of 0x000 and 0xFFF, a number is simply a number, nothing more.

By further reading more about VLAN hopping, I get their idea of putting VLAN1 as untagged traffic (aka native VLAN) on the trunk link, so if we put other access ports (non-trunk) in the same VLAN1, a hacker can exploit it by inserting a tag and send data to any VLAN.

They say that VLAN1 is usually the default VLAN ID for access port, and that the trunk port sends traffic of VLAN1 as untagged (aka native VLAN1). That's why they recommend avoid using VLAN1 for access port. Before that exploit has any chance to happen, why do they want to ouput VLAN1 traffic as untagged on the trunk link? Why don't they just tag everything which flows through it?

Improve this question

1 Answer 1

Reset to default
6

The default VLAN and the native VLAN are really two different concepts that are often mixed up because they are often the same VLAN, but they may not need to be.

VLAN 1 is the default VLAN (meaning not configuring a VLAN on a switch interface will leave it in VLAN 1). The bad guys know that it exists on your network, unless you take steps to remove it or not allow it. Some vendors even require VLAN 1, as do some versions of spanning tree (STP versions may require it as both the default and native VLAN). Because it is the default VLAN, a lot of people also use that as the management VLAN for their network devices. All of this makes it a prime target for the bad guys.

Because frames on trunks are tagged to separate the frames into VLANs so the frames can be placed in the correct VLAN on the other end of the trunk, that means that one VLAN could be untagged and still separated, and that is called the native VLAN. Because VLAN 1 is the default VLAN, it ends up as the native VLAN by default. Depending on the vendor and version of spanning tree used, you may be able to change the native VLAN to a different VLAN.

Avoiding the use of VLAN 1 and not having a native VLAN makes it just that much harder for the bad guys, and it is a simple thing. Cisco recommends not using VLAN 1, restricting VLAN 1 from trunk links (switchport trunk allowed command), and not using a native VLAN on the trunks, meaning that all the VLANs on a trunk would be tagged, and there would be no VLAN 1 frames. In fact, you should restrict trunks to only allow VLANs that are required on the other end of the trunk link, but a lot of people just let it default to allowing all VLANs. Also, you should disable VTP by putting the switches into transparent mode. There is also a command to tag the native VLAN, which means that you really do not have a native VLAN.

Remember that VLANs were bolted onto ethernet after the fact, and there really was not the huge problem of people hacking into networks and trying to cause problems back when the standards were created.

Improve this answer
5
  • So, the main reason is that VLAN1 is too popular, as it is the default on most devices. When hackers get access to the network, they tend to target it. So we avoid using VLAN1 to make it harder for them to guess which VLANs we are using internally, hence harder to perform an (eg: DDOS) attack to a specific host?
    – Livy
    Dec 19, 2019 at 7:36
  • 2
    Well, the VLANs are only important inside the company, not from outside, but there are plenty of bad guys inside the company, too. In fact the vast majority of attacks are inside jobs. There is a book, LAN Switch Security: What Hackers Know About Your Switches, that details a lot of layer-2 vulnerabilities and how to mitigate them.
    – Ron Maupin ♦
    Dec 19, 2019 at 7:40
  • One more thing, which is not really clear in your answer though, that is why we need a native VLAN? Why do we (and the switch manufacturers) just tag everything, and disallow untagged frames on trunk link in the first place? Untagged frames, as I understand, are used to communicate with a VLAN-unaware device. And now we are having 2 VLAN-capable devices on both ends of a trunk link. So why would we use native VLAN? With no native VLAN on the trunk link (by dropping all untagged traffic), there will be no more VLAN hopping, and we do not need to care about VLAN1 or whatsoever.
    – Livy
    Dec 19, 2019 at 14:00
  • @Livy simply for backward compatibility with devices that don’t speak ISL (Cisco proprietary) or dot1q. VLANs are common now but they never would have been adopted without this.
    – Gaius
    Dec 19, 2019 at 17:54
  • @Livy, VLANs were added to ethernet, so the basic ethernet has no VLAN tags, which is why there is a native VLAN (no VLAN tag). Most end-devices (PCs, printers, etc.) do not understand VLAN tags, and will drop frames that are tagged as giants or malformed. Having a native VLAN would allow end-devices to connect to an interface configured as a trunk. Some STP versions assume a native (untagged VLAN), and they use that for spanning tree. Cisco actually has Per VLAN spanning tree, and it tags the spanning tree frames, but that is not part of the IEEE standard.
    – Ron Maupin ♦
    Dec 19, 2019 at 18:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.