Content

| 2.2 |  | VLAN Security |
| 2.2.1 |  | Overview |

Routers allow administrators to introduce policies that control the flow of traffic in the network. ACLs control traffic flow and provide varied degrees of policy granularity. Access lists can prevent a specific user from communicating with another user or network, or they can prevent an entire network from accessing a user or network. Access lists are sometimes implemented for security reasons, and they are also used to prevent traffic from flowing through a segment to protect local bandwidth.

In any case, the management of ACLs can be quite cumbersome. Access Control Lists in a production network should be based on the organization’s business and security needs.

To safeguard the Accounting department’s data, filters in the routers attached to the engineering segment can include ACLs allowing the accounting traffic to pass through the engineering segment, but never talk to any engineering devices. That does not prevent engineers from monitoring the traffic, but does prevent direct communication between the engineering and accounting devices. Accounting will not see the engineering traffic, but engineering can see all the accounting transit traffic.

Switches traditionally operate at Layer 2 only, switching traffic within a VLAN, whereas routers route traffic between VLANs. The Catalyst 3550 switch with the Enhanced Multilayer Image (EMI) installed can accelerate packet routing between VLANs by using Layer 3 switching. The switch bridges the packet, the packet is then routed internally without going to an external router, and then the packet is bridged again to send it to its destination. During this process, the switch can enforce ACLs on all packets it switches, including packets bridged within a VLAN.

Layer 3 switching combines the traditional “router-on-a-stick” with a Layer 2 switch. Access lists can be configured on a Layer 3 switch to provide basic security and traffic management for the network.