Blog

Which of the following are common security risks associated with VLANs on Cisco switches?

• VLAN hopping attacks
• MAC address flooding
• Switch spoofing
• IP address spoofing
• STP manipulation

The correct answers are:

• VLAN hopping attacks
• MAC address flooding
• Switch spoofing
• STP manipulation

Introduction to VLAN Security Risks

Virtual LANs (VLANs) are a fundamental component of modern network design, allowing for logical segmentation of networks to improve performance, manageability, and security. However, VLANs are not immune to security vulnerabilities. Inadequately configured VLANs can expose networks to a variety of security risks that attackers can exploit to gain unauthorized access, disrupt network operations, or intercept sensitive data. Understanding these risks and implementing appropriate countermeasures is critical to maintaining a secure network environment.

Below, we will explore each of the listed security risks associated with VLANs on Cisco switches in detail.

VLAN Hopping Attacks

VLAN hopping is one of the most notorious VLAN-related security threats. In a VLAN hopping attack, an attacker sends packets to a switch in such a way that the switch forwards the traffic to a different VLAN than the one the traffic originated from. This allows the attacker to “hop” from one VLAN to another, bypassing the intended VLAN isolation.

There are two primary methods by which VLAN hopping can occur:

1. Switch Spoofing: In this method, the attacker configures their device to behave like a switch by emulating Dynamic Trunking Protocol (DTP) messages. If the switch port is configured to dynamically negotiate trunking, the attacker’s device can establish a trunk link, gaining access to all VLANs that are allowed on the trunk.
2. Double-Tagging: In this method, the attacker sends a specially crafted packet with two VLAN tags. The first tag is the attacker’s VLAN (native VLAN), and the second tag is the target VLAN. The switch, upon receiving this double-tagged packet, removes the first tag (since it’s the native VLAN), and forwards the packet to the target VLAN, thereby allowing the attack to “hop” into another VLAN.

Countermeasures for VLAN Hopping:

• Disable DTP on all ports by setting them to switchport mode access.
• Explicitly specify allowed VLANs on trunk ports using the switchport trunk allowed vlan command.
• Set the native VLAN to a VLAN that is not used by any user devices and avoid using VLAN 1 for anything critical.
• Manually configure trunking on ports rather than relying on dynamic negotiation.

MAC Address Flooding

MAC address flooding is an attack that targets the switch’s CAM (Content Addressable Memory) table, which stores MAC addresses and their associated switch ports. In a MAC address flooding attack, the attacker floods the switch with frames containing bogus source MAC addresses. This results in the switch’s CAM table being filled to capacity, causing it to operate in a “fail-open” mode where it starts broadcasting traffic out of all ports, rather than only to the correct destination port.

The consequence of this attack is that the attacker can potentially intercept traffic from other VLANs, as the switch can no longer correctly forward traffic to the intended VLAN.

Countermeasures for MAC Address Flooding:

• Enable Port Security: Port security allows you to limit the number of MAC addresses that can be learned on a switch port. Once the limit is reached, the switch can either shut down the port, drop additional MAC addresses, or generate an alert.
• Configure Static MAC Address Entries for critical devices, ensuring that only known devices can communicate on specific ports.
• Use VLAN ACLs (Access Control Lists) to restrict traffic between VLANs and limit potential exposure.
• Monitor and audit network traffic to detect anomalies that might indicate a MAC flooding attack.

Switch Spoofing

Switch spoofing is closely related to VLAN hopping but is a specific method within that category. In a switch spoofing attack, the attacker configures their machine to imitate a switch, typically using the Dynamic Trunking Protocol (DTP) to negotiate a trunk link with the genuine switch. Once the trunk link is established, the attacker gains access to all VLANs that are allowed on the trunk, bypassing the VLAN isolation mechanism.

Switch spoofing is particularly dangerous because it allows the attacker to access multiple VLANs from a single compromised device, making lateral movement within the network much easier.

Countermeasures for Switch Spoofing:

• Disable DTP on all switch ports that do not require trunking by setting them to switchport mode access and using the switchport nonegotiate command.
• Manually configure trunk links rather than relying on automatic negotiation.
• Use VLAN pruning to restrict the VLANs that are allowed on each trunk link to only those that are necessary.
• Apply ACLs to control which devices can communicate across different VLANs.

STP Manipulation

Spanning Tree Protocol (STP) manipulation is an attack where the attacker attempts to influence the STP topology by sending spoofed Bridge Protocol Data Units (BPDUs) with a lower bridge priority, effectively making their device the root bridge. Once the attacker’s device becomes the root bridge, they can influence the network’s data flow, potentially intercepting, redirecting, or blocking traffic.

This type of attack can disrupt the normal operation of the network, leading to outages or degraded performance, and can be used in conjunction with other attacks to capture or modify traffic.

Countermeasures for STP Manipulation:

• Enable BPDU Guard: This feature disables a port if a BPDU is received where it shouldn’t be, effectively preventing rogue switches from participating in STP.
• Configure Root Guard on ports where the root bridge should not be located, preventing an attacker from becoming the root bridge.
• Use STP features like BPDU filtering to control which devices can influence the spanning tree topology.
• Implement PortFast on access ports to ensure that end devices can connect without participating in the STP process.

Conclusion

VLANs are essential for logical segmentation within a network, enhancing both performance and security. However, VLANs come with their own set of security challenges. VLAN hopping, MAC address flooding, switch spoofing, and STP manipulation are some of the most common security risks associated with VLANs on Cisco switches. Each of these attacks exploits different aspects of VLAN or switch configurations, allowing attackers to bypass security measures, intercept traffic, or disrupt network operations.

To mitigate these risks, network administrators must adopt a multi-layered security approach, including disabling unnecessary features, enforcing strict port security, limiting VLAN access, and monitoring network traffic for signs of attack. By understanding and addressing these vulnerabilities, organizations can significantly reduce the risk of unauthorized access and maintain a secure and efficient network environment.