RE: VLAN Security

["Vinicius Moreira Mello" <vinicius () lineone net>]

> -- Original Message --
> From: Jeff Boles <bolesjb () yahoo com>
> To: firewall-wizards () honor icsalabs com
> Subject: [fw-wiz] VLAN Security
> Date: Tue, 8 Jun 2004 10:18:02 -0700 (PDT)
>
>
> Anyone care to voice their consensus on contemporary
> VLAN implementations as a security measure?
Jeff,

Keep in mind that VLANs are not designed for security, they're designed
for network segmentation. I've seen many telecommunication companies selling
WAN VPNs over MPLS that seems to be more secure than VLANs in a case like
this.

> Anybody care to voice an argument on on VLAN integrity
> in the provider network?

Anyway, when using VLANs there are some safe configurations:

- do not put any network on the default vlan (vlan id 1) (potencial L2 flooding,
DoS)
- do not put untrusted networks on native VLANs of trunk ports (vlan jumping,
vtp vlan erasing)
- if not absolutely necessary disable all VTP protocols.    Otherwise use
protocol authentication.

Regards,
vmm.

_______________________________________________
firewall-wizards mailing list
firewall-wizards () honor icsalabs com
http://honor.icsalabs.com/mailman/listinfo/firewall-wizards