Content

| 2.1 |  | VLAN Basics |
| 2.1.3 |  | VLANs and network security |

Almost everything in networking has a connection to security. With VLAN technology, security is essentially a side effect. With the exception of the private VLANs that are available on Catalyst 4000 and 6000 switches, security was not originally a motivating factor for the creation of VLANs.

The shared-media nature of legacy networks is a security issue. Whenever a station transmits in a shared network such as a legacy half-duplex 10BASE-T system, all stations attached to the segment receive a copy of the frame, even if they are not the intended recipients. This does not prevent the network from functioning, but readily available software packages that monitor network traffic make it possible for anyone to capture passwords, sensitive e-mail, and any other unencrypted traffic on the network.

If the users on the network belong to the same department, this might not be disastrous, but when users from mixed departments share a segment, sensitive information can be compromised. For example, if someone from human resources or accounting sends sensitive data such as salaries, stock options, or health records on the shared network, anyone with a network-monitoring tool on that LAN can intercept the information.

In fact, these problems are not constrained to a single LAN segment. These problems can occur in multisegment environments interconnected with routers. If the accounting department resides on two isolated segments, then packets from one segment must cross the engineering network in order to reach the other accounting segment. When they cross the engineering segment, it is possible for that information to be intercepted and misused.

One way to eliminate the problem is to move all accounting users onto the same segment, but that may not be possible. There might be space limitations that prevent all accountants from sharing a common part of the building. Another reason may deal with the geographical makeup of the company. Users on one segment might be a considerable distance from users on the other segment.

In most cases, assuming physical security of a switch and password-protected remote access, the issue of intercepting data due to shared-media technology should not be a problem. Virtually all hosts in modern networks reside on switched ports, so unicast data is not normally visible to any hosts except the sender and receiver. There are however applications that can redirect data in a switched network to a single host. In some cases, it is also possible to flood a switch with data and make it act like a hub. It should not be possible to intercept data in a switched environment, but a comprehensive security policy should take this possibility into account, especially if the LAN carries sensitive data.

Another approach is through the use of VLANs. VLANs add one additional layer of isolation between hosts and therefore make it much more difficult for data to be intercepted. All process-related users can be contained in the same broadcast domain and isolated from users in other broadcast domains. All of the accounting users can be assigned to the same VLAN, regardless of their physical location in the facility. In fact, all of the users can be assigned to VLANs based upon their job function. For example, all of the accounting users could go on one VLAN, the marketing users on another VLAN, and engineering in a third.

When VLANs are implemented with switched network devices, another level of protection is added to the network. Switches bridge traffic within a VLAN. When a station transmits, the frame goes to the intended destination. As long as it is a known unicast frame, the switch does not distribute the frame to all users in the VLAN.

Station A transmits a frame to Station B attached to another Catalyst Switch. Although the frame crosses through a Catalyst Switch, only the destination receives a copy of the frame. The switch filters the frame from the other stations, whether they belong to a different VLAN or the same VLAN. This switch feature limits the opportunity for packets to be captured with a network analyzer.

Hosts on different VLANs cannot communicate with each other unless the network is explicitly configured to allow it. If the network has a one-to-one mapping between IP subnets and VLANs, hosts on different VLANs must communicate through IP routing. In this case, access control lists (ACLs) can filter traffic between VLANs. It is possible to configure VLANs without inter-VLAN routing, but in reality this is rarely done.

Another case where VLANs play a definitive role in network security is the ability to configure access control lists on switches.

Although these security methods may seem excessive, in the corporate network they are crucial. Consider the data transferred within a company’s accounting department. This department has salary information, stock option information, personal information, and other sensitive and personal material. It is very important to protect the privacy of the users and the integrity of the data. VLANs greatly assist in this endeavor.