CCNP Routing and Switching SWITCH 300-115 Official Cert Guide (2015)

Part VII. Securing Switched Networks

Chapter 20. Securing VLANs

This chapter covers the following topics that you need to master for the CCNP SWITCH exam:

VLAN Access Lists: This section discusses how traffic can be controlled within a VLAN. You can use VLAN access control lists (ACL) to filter packets even as they are bridged or switched.

Private VLANs: This section explains the mechanisms that you can use to provide isolation within a single VLAN. Private VLANs have a unidirectional nature; several of them can be isolated yet share a common subnet and gateway.

Securing VLAN Trunks: This section covers two types of attacks that can be leveraged against a VLAN trunk link. If a trunk link is extended to or accessible from an attacker, any VLAN carried over the trunk can be compromised in turn.

Traditionally, traffic has been filtered only at router boundaries, where packets naturally are inspected before being forwarded. This is true within Catalyst switches because access lists can be applied as a part of multilayer switching. Catalysts also can filter packets even if they stay within the same VLAN; VLAN access control lists, or VACLs, provide this capability.

Catalyst switches also have the capability to logically divide a single VLAN into multiple partitions. Each partition can be isolated from others, with all of them sharing a common IP subnet and a common gateway address. Private VLANs make it possible to offer up a single VLAN to many disparate customers or organizations without any interaction between them.

VLAN trunks are commonly used on links between switches to carry data from multiple VLANs. If the switches are all under the same administrative control, it is easy to become complacent about the security of the trunks. A few known attacks can be used to gain access to the VLANs that are carried over trunk links. Therefore, network administrators should be aware of the steps that can be taken to prevent any attacks.

“Do I Know This Already?” Quiz

The “Do I Know This Already?” quiz allows you to assess whether you should read this entire chapter thoroughly or jump to the “Exam Preparation Tasks” section. If you are in doubt based on your answers to these questions or your own assessment of your knowledge of the topics, read the entire chapter. Table 20-1 outlines the major headings in this chapter and the “Do I Know This Already?” quiz questions that go with them. You can find the answers in Appendix A, “Answers to the ‘Do I Know This Already?’ Quizzes.”

Table 20-1 “Do I Know This Already?” Foundation Topics Section-to-Question Mapping

1. Which one of the following can filter packets even if they are not routed to another Layer 3 interface?

a. IP extended access lists

b. MAC address access lists

c. VLAN access lists

d. Port-based access lists

2. In what part of a Catalyst switch are VLAN ACLs implemented?

a. NVRAM

b. CAM

c. RAM

d. TCAM

3. Which one of the following commands can implement a VLAN ACL called test?

a. access-list vlan test

b. vacl test

c. switchport vacl test

d. vlan access-map test

4. After a VACL is configured, where is it applied?

a. Globally on a VLAN

b. On the VLAN interface

c. In the VLAN configuration

d. On all ports or interfaces mapped to a VLAN

5. Which of the following private VLANs is the most restrictive?

a. Community VLAN

b. Isolated VLAN

c. Restricted VLAN

d. Promiscuous VLAN

6. The vlan 100 command has just been entered. What is the next command needed to configure VLAN 100 as a secondary isolated VLAN?

a. private-vlan isolated

b. private-vlan isolated 100

c. pvlan secondary isolated

d. No further configuration necessary

7. What type of port configuration should you use for private VLAN interfaces that connect to a router?

a. Host

b. Gateway

c. Promiscuous

d. Transparent

8. Promiscuous ports must be ______________ to primary and secondary VLANs, and host ports must be ________________.

a. Mapped, associated

b. Mapped, mapped

c. Associated, mapped

d. Associated, associated

9. In a switch spoofing attack, an attacker makes use of which one of the following?

a. The switch management IP address

b. CDP message exchanges

c. Spanning Tree Protocol

d. DTP to negotiate a trunk

10. Which one of the following commands enables you to prevent a switch spoofing attack on an end-user port?

a. switchport mode access

b. switchport mode trunk

c. no switchport spoof

d. spanning-tree spoof-guard

11. Which one of the following represents the spoofed information an attacker sends in a VLAN hopping attack?

a. 802.1Q tags

b. DTP information

c. VTP information

d. 802.1x information

12. Which one of the following methods can be used to prevent a VLAN hopping attack?

a. Use VTP throughout the network.

b. Set the native VLAN to the user access VLAN.

c. Remove the native VLAN from a trunk link.

d. Avoid using EtherChannel link bundling.

Foundation Topics

VLAN Access Lists

Access lists can manage or control traffic as it passes through a switch. When normal access lists are configured on a Catalyst switch, they filter traffic through the use of the ternary content-addressable memory (TCAM). Recall from Chapter 2, “Switch Operation,” that access lists (also known as router access lists, or RACLs) are merged or compiled into the TCAM. Each ACL is applied to an interface according to the direction of traffic—inbound or outbound. Packets then can be filtered in hardware with no switching performance penalty. However, only packets that passbetween VLANs can be filtered this way.

Packets that stay in the same VLAN do not cross a VLAN or interface boundary and do not necessarily have a direction in relation to an interface. These packets also might be non-IP or completely bridged; therefore, they never pass through the multilayer switching mechanism. VLAN access lists (VACLs) are filters that directly can affect how packets are handled within a VLAN.

VACLs are somewhat different from RACLs or traditional access control lists. Although they, too, are merged into the TCAM, they can permit, deny, or redirect packets as they are matched. VACLs also are configured in a route map fashion, with a series of matching conditions and actions to take.

VACL Configuration

VACLs are configured as a VLAN access map in much the same format as a route map. A VLAN access map consists of one or more statements, each having a common map name. First, you define the VACL with the following global configuration command:

Switch(config)# vlan access-map map-name [sequence-number]

Access map statements are evaluated in sequence according to the sequence number. Each statement can contain one or more matching conditions, followed by an action.

Next, define the matching conditions that identify the traffic to be filtered. Matching is performed by access lists (IP or MAC address ACLs), which you must configure independently. Configure a matching condition with one of the following access map configuration commands:

Switch(config-access-map)# match ip address {acl-number | acl-name}
Switch(config-access-map)# match mac address acl-name

You can repeat these commands to define several matching conditions; the first match encountered triggers an action to take. Define the action with the following access map configuration command:

Switch(config-access-map)# action {drop | forward [capture] | redirect type mod/
num}

A VACL can either drop a matching packet, forward it, or redirect it to another interface. The TCAM performs the entire VACL match and action as packets are switched or bridged within a VLAN or routed into or out of a VLAN.

Finally, you must apply the VACL to a VLAN using the following global configuration command:

Switch(config)# vlan filter map-name vlan-list vlan-list

Notice that the VACL is applied globally to one or more VLANs listed and not to a VLAN interface switch virtual interface (SVI). Recall that VLANs can be present in a switch as explicit interfaces or as inherent Layer 2 entities. The VLAN interface is the point where packets enter or leave a VLAN, so it does not make sense to apply a VACL there. Instead, the VACL needs to function within the VLAN itself, where there is no inbound or outbound direction.

For example, suppose that you need to filter traffic within VLAN 99 so that host 192.168.99.17 is not allowed to contact any other host on its local subnet. Access list local-17 is created to identify traffic between this host and anything else on its local subnet. Then a VLAN access map is defined: If the local-17 access list matches (permits) the IP address, the packet is dropped; otherwise, the packet is forwarded. Example 20-1 shows the commands necessary for this example.

Example 20-1 Filtering Traffic Within the Local Subnet