Contents
How can VLAN hopping using a trunk port be prevented?
Double tagging can be prevented using a three-step process. First, avoid putting any hosts on the default VLAN (VLAN 1). Second, be sure that the native VLAN on every trunk port is an unused VLAN ID. Finally, enable explicit tagging of the native VLAN for all trunk ports.
How can VLAN hopping be avoided?
To prevent the VLAN hopping from being exploited, we can do the below mitigations: Ensure that ports are not set to negotiate trunks automatically by disabling DTP: NEVER use VLAN 1 at all. Disable unused ports and put them in an unused VLAN ▪ Always use a dedicated VLAN ID for all trunk ports.
What is switch spoofing VLAN hopping attack?
Switch spoofing is a type of VLAN hopping attack that works by taking advantage of an incorrectly configured trunk port. By tricking a switch into thinking that another switch is attempting to form a trunk, an attacker can gain access to all the VLANs allowed on the trunk port.
What is the normal range for VLAN?
VLAN Ranges
| VLANs | Range | Usage |
|---|---|---|
| 1 | Normal | Cisco default. You can use this VLAN but you cannot delete it. |
| 2-1001 | Normal | For Ethernet VLANs; you can create, use, and delete these VLANs. |
| 1002-1005 | Normal | Cisco defaults for FDDI and Token Ring. You cannot delete VLANs 1002-1005. |
| 1006-4094 | Extended | For Ethernet VLANs only. |
How is DTP used in VLAN hopping attacks?
DTP is a Cisco proprietary protocol where one use is to dynamically establish a trunk link between two switches. An attacker acts as a switch in order to trick a legitimate switch into creating a trunking link between them. As mentioned before, packets from any VLAN are allowed to pass through a trunking link.
Why are Cisco switches vulnerable to VLAN hopping?
Some Cisco switches ports default to auto mode for trunking. That means that the ports automatically become trunk ports if they receive Dynamic Trunking Protocol (DTP) frames on some of the switch ports. This is big security problem because attacker can make his switch port become trunk and then he can easily perform VLAN hopping attacks.
How to prevent VLAN hopping using double tagging?
To help prevent a VLAN hopping attack using double tagging, do not use the native VLAN to send user traffic. You can do this by creating a VLAN that does not have any ports added. This unused VLAN is only for the native VLAN assignment. Configuration on a Cisco switch is shown in which the native VLAN has been set to an unused VLAN.
Can a VLAN be used as a trunk?
As mentioned before, packets from any VLAN are allowed to pass through a trunking link. Once the trunk link is established, the attacker then has access to traffic from any VLAN. This exploit is only successful when the legitimate switch is configured to negotiate a trunk.