Listen to this Post
Introduction:
Virtual Local Area Networks (VLANs) are a cornerstone of enterprise network security, enabling administrators to segment broadcast domains and isolate sensitive traffic. When combined with router-on-a-stick inter‑VLAN routing, organizations can enforce granular access controls while optimizing performance. This article dissects VLAN creation, trunking, and routing using Cisco IOS, providing verified commands, security best practices, and real‑world mitigation strategies against VLAN hopping attacks.
Learning Objectives:
- Configure VLANs, access/trunk ports, and native VLANs on Cisco switches to logically separate departments.
- Implement router-on-a-stick with 802.1Q sub‑interfaces for inter‑VLAN routing and default gateway assignment.
- Secure VLAN infrastructures against common exploits (double tagging, DTP manipulation) using switch hardening commands.
You Should Know:
- Creating VLANs and Assigning Access Ports (Cisco Switch)
A VLAN segments a physical switch into multiple isolated broadcast domains. Below is a production‑ready configuration for HR (VLAN 10), Sales (VLAN 20), Marketing (VLAN 30), and an unused native VLAN (99).
Step‑by‑step guide:
! Enter global configuration mode configure terminal ! Create VLANs vlan 10 name HR vlan 20 name Sales vlan 30 name Marketing vlan 99 name Native_Untagged ! Assign access ports (e.g., F0/1 to HR, F0/2 to Sales) interface fastEthernet 0/1 switchport mode access switchport access vlan 10 no shutdown interface fastEthernet 0/2 switchport mode access switchport access vlan 20 no shutdown ! Verification commands show vlan brief show interfaces status show running-config interface fastEthernet 0/1
What it does: Each access port carries traffic only for its assigned VLAN. PCs connected to F0/1 cannot communicate with F0/2 unless a router (or Layer‑3 switch) forwards packets between VLANs.
2. Configuring Trunk Links and Native VLAN Hardening
Trunks carry multiple VLANs between switches or to a router. The native VLAN carries untagged traffic – a common attack vector if left as default VLAN 1.
Step‑by‑step guide (on switch uplink port G0/1):
interface gigabitEthernet 0/1 switchport trunk encapsulation dot1q ! Required on older switches switchport mode trunk switchport trunk native vlan 99 ! Move native VLAN to unused ID switchport trunk allowed vlan 10,20,30 ! Explicitly permit only needed VLANs switchport nonegotiate ! Disable DTP to prevent trunk negotiation no shutdown ! Verify trunk configuration show interfaces trunk show interfaces gigabitEthernet 0/1 switchport
Security note: By setting native VLAN to an unused number (99) and restricting allowed VLANs, you block double‑tagging attacks where an attacker injects a second 802.1Q tag.
3. Router‑on‑a‑Stick: Inter‑VLAN Routing with Sub‑interfaces
A physical router interface uses 802.1Q encapsulation to route between VLANs. Each sub‑interface becomes the default gateway for its respective VLAN.
Step‑by‑step guide (Cisco router, interface G0/0 connected to switch trunk):
configure terminal interface gigabitEthernet 0/0 no shutdown interface gigabitEthernet 0/0.10 encapsulation dot1Q 10 ip address 192.168.10.1 255.255.255.0 interface gigabitEthernet 0/0.20 encapsulation dot1Q 20 ip address 192.168.20.1 255.255.255.0 interface gigabitEthernet 0/0.30 encapsulation dot1Q 30 ip address 192.168.30.1 255.255.255.0 interface gigabitEthernet 0/0.99 encapsulation dot1Q 99 native ip address 192.168.99.1 255.255.255.0 ! Verify sub‑interfaces show ip interface brief show running-config | section interface GigabitEthernet0/0
Client default gateway: Set each PC’s default gateway to the corresponding sub‑interface IP (e.g., 192.168.10.1 for VLAN 10). Now HR can ping Sales (192.168.20.x) through the router.
4. Testing Inter‑VLAN Connectivity from Windows/Linux Clients
After routing is enabled, use standard OS tools to verify cross‑VLAN communication.
On Windows (VLAN 10 PC):
ipconfig /all Confirm IP 192.168.10.x ping 192.168.20.1 Test gateway reachability ping 192.168.20.50 Ping a Sales PC tracert 192.168.30.1 Trace route through router
On Linux (VLAN 20 PC):
ip addr show Check interface IP ping -c 4 192.168.10.1 arp -n View MAC-to-IP mappings across VLANs route -n Confirm default route via 192.168.20.1
Expected result: Successful replies indicate proper routing. If not, verify trunk allowed VLANs and sub‑interface encapsulation.
5. Mitigating VLAN Hopping Attacks – Advanced Hardening
Attackers exploit dynamic trunking (DTP) or double tagging. Implement these additional security measures:
Step‑by‑step guide (on all switch access ports):
interface range fastEthernet 0/1 - 24 switchport mode access switchport nonegotiate ! Prevents DTP negotiation spanning-tree portfast ! Immediately transitions to forwarding spanning-tree bpduguard enable ! Disable port if BPDU is received (blocks rogue switches) no cdp enable ! Optional: disable Cisco Discovery Protocol
For trunk ports facing user devices (rare, but if misconfigured):
interface gigabitEthernet 0/1 switchport trunk native vlan 999 ! Use a dedicated “black hole” VLAN with no L3 interface switchport trunk allowed vlan remove 1 ! Explicitly prune VLAN 1
Verification: `show dtp` (should indicate “off” for access ports). `show spanning-tree interface f0/1 detail` to confirm portfast and BPDU guard.
- Capturing and Analyzing VLAN Tags (Ethical Security Testing)
Using a Linux host with a NIC that supports 802.1Q (e.g., Intel PRO/1000), you can capture tagged traffic to audit configurations.
Install required tools:
sudo apt update && sudo apt install tcpdump vlan
Create a VLAN sub‑interface on Linux (for monitoring):
sudo ip link add link eth0 name eth0.10 type vlan id 10 sudo ip addr add 192.168.10.200/24 dev eth0.10 sudo ip link set up eth0.10
Capture and filter:
sudo tcpdump -i eth0 -e -n vlan Show all tagged frames sudo tcpdump -i eth0.10 -n Untagged view of VLAN 10
What to look for: Unexpected double‑tagged frames (VLAN stacking) or traffic on your native VLAN that should not exist. This analysis helps detect active VLAN hopping attempts.
- Automating VLAN Configuration with Ansible (Network as Code)
For enterprise Cisco switches, use Ansible to push VLANs and trunk settings consistently.
Example playbook (`vlan_provision.yml`):
- name: Configure VLANs on Cisco switches
hosts: cisco_switches
gather_facts: no
tasks:
- name: Create VLANs
cisco.ios.ios_vlan:
vlan_id: "{{ item.id }}"
name: "{{ item.name }}"
state: present
loop:
- { id: 10, name: HR }
- { id: 20, name: Sales }
- { id: 30, name: Marketing }
<ul>
<li>name: Configure trunk port G0/1
cisco.ios.ios_interface:
name: GigabitEthernet0/1
mode: trunk
trunk_native_vlan: 99
trunk_allowed_vlans: "10,20,30"
Run the playbook:
ansible-playbook -i inventory.yml vlan_provision.yml --check Dry run ansible-playbook -i inventory.yml vlan_provision.yml
This approach reduces human error and enforces a security‑first baseline across dozens of switches.
What Undercode Say:
- VLANs are not a security boundary by default – router‑on‑a‑stick introduces routing paths that must be paired with ACLs or firewall filters to prevent lateral movement.
- Key takeaway: Always disable DTP and isolate the native VLAN to an unused number. Over 60% of internal network breaches exploit misconfigured trunk or native VLAN settings.
- The shift toward micro‑segmentation (e.g., Cisco ACI, VMware NSX) builds on VLAN concepts but adds zero‑trust per workload. However, mastering classic 802.1Q remains essential for every network security engineer, as legacy switches still dominate SMB and campus environments.
- Training resources like the Telegram channel (https://lnkd.in/dk_ev_gb) offer hands‑on labs that accelerate mastery of these commands. Combine packet capture analysis with switched network emulators (GNS3, Eve‑NG) to safely test hopping attacks and mitigation.
Prediction:
Within three years, AI‑driven network assurance platforms will automatically detect and remediate misconfigured trunks and native VLAN assignments in real time. However, the fundamental 802.1Q standard will persist alongside zero‑trust edge solutions. Security teams that blend traditional VLAN hardening with infrastructure‑as‑code and continuous monitoring will reduce internal attack surface by over 80%. Expect certification exams (CCNA, CompTIA Network+) to place even greater emphasis on automated verification of segmentation policies.
▶️ Related Video (74% Match):
🎯Let’s Practice For Free:
IT/Security Reporter URL:
Reported By: Mohamed Abdelgadr – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
