Please enable JavaScript.

Coggle requires JavaScript to display documents.

R&S C3 : VLANs (3.2 VLAN Implementations (3.2.1 VLAN Assiignment (3.2…

- - - - Normal Range VLANs
        
        1-1005
        
        small- medium sized business/enterprise networks
        
        IDs 1002 - 1005 reserved for Toking Ring and FDDI VLANs
        
        vlan.dat
        
        VTP : Vlan Trunking Protocol
        
        helps manage VLAN
        configurations
        between switches
      - Extended Range VLANs
        
        1006-4094 (12bits)
        
        configurations not written to the vlan.dat
        
        support fewer VLAN features than normal range VLANs
        
        VTP does not learn extended range VLANs
    - - config t > vlan 20 > name Student > end > show vlan brief
    - - config t > interface F0/18 > switchport mode access > switchport access vlan 20 > end
      - only with IP phone the possibility to two VLANs associated with the port , one for voice and one for data
      - security best practise
        
        switchport mode access
    - - conf t >
        no vlan 20
        end
        sh vlan brief
      - delete vlan.dat
        
        delete flash:vlan.dat
    - - /
    - - conf t > interface F0/18 >
        no switchport access vlan >
        do show vlan brief
      - interface F0/11 >
        switchport mode access >
        switchport access vlan 20
        end
  - - - OSI Layer 2 link between
        two switches that carries
        trafic for all VLANs
        
        VLANs can be restricted
      - conf t >
        interface f0/18 >
        switchport mode trunk >
        switchport trunk native vlan 99 >
        switchport trunk allowed vlan 10,20,30
        end
    - - conf t >
        interface f0/18 >
        no switchport trunk allowed vlan >
        no switchport trunk native vlan >
        end
    - - interface f0/1 >
        switchport mode trunk >
        switchport trunk native vlan 99 >
        end >
        show interfaces f0/1 switchport
  - - - interface trunking or not trunking or
        negotiation trunking with neighbor interface.
        
        managed by Dynamic Trunking Protocol (DTP)
      - enable trunking
        
        switchport mode trunk
        and
        switchport nonegotiate
    - - ------------------- dynamic auto --- dynamic desirable --- trunk --- access
        dynamic auto - access --- trunk --- trunk --- access
        dynamic desirable - trunk --- trunk --- trunk --- access
        trunk - trunk --- trunk --- trunk --- limited cone
        access - access --- access --- limi con --- access
  - - - same subnet address to communicate
    - - show vlan >
        switchport access vlan
        show mac address-table
      - show vlan
        show interfaces switchport
        show mac-address-table
        switchport access vlan
        show interface f0/1 switchport
    - - local and peer native
        VLANs match
    - - Native VLAN mismatches
        
        poses a security risk and
        creates unintended results
        
        for example, one port is defined as
        VLAN 99 and the other is defined as VLAN 100
      - Trunk mode
        mismatches
        
        causes loss of
        network connectivity
        
        for example, both local and peer
        switchport modes are configured as dynamic auto
      - Allowed VLANs
        on trunks
        
        Causes unexpected traffic or no
        traffic to be sent over the trunk
        
        the list of allowed VLANs does
        not support current VLAN
        trunkng requirements
- - - - VLANs based on logical connections
        instead of physical connections
    - - Security
      - Cost reduction
      - better performance
      - shrink broadcast domains
        
        3 broadcast domains over 6 computers, > faculty, student, guest
      - imporved IT staff efficiency
      - simpler project and
        application management
    - - Data VLAN
        
        carry user-generated traffic
        
        voice / management traffic is not data VLAN
      - Default VLAN
        
        after boot up , all ports become part of the default VLAN
      - Native VLAN
        
        assigned to 802.1Q
        trunk port
        
        trunk ports links between switches,
        support transmission of traffic associated
      - Management VLAN
        
        access management capabilities of a switch
    - - seperated VLAN needed
        to support VoIP
        
        assured bandwidth
        to ensure voice quality
        
        transmission priority
        over other types of network traffic
        
        ability to be routed around congested areas on the network
  - - - trunk is point-to-point link between two network devices that carries more than one VLAN
      - VLAN trunk extends VLANs across an entire network
    - - Network without VLANs
        
        broadcast to all other ports
      - Network with VLANs
        
        broadcast send to all computers within that VLAN
    - - VLAN Tag Field Details
        
        Type
        
        User priority
        
        Canonical Format Identifier (CFI)
        
        VLAN ID (VID)
    - - Tagged Frames
        on the Native VLAN
        
        Native VLAN should
        not include Tagg
        
        if 802.1Q trunk port receives
        a tagged frame with the VLAN ID
        same as native VLAN
        
        frame dropped
      - Untagged Frames
        on the Native VLAN
        
        forward frames to
        native VLAN
        
        no devices connected to
        native VLAN
        and no other trunk ports
        
        frame dropped
        
        configuring 802.1Q trunk port, default Port VLAN ID(PVID) is assigned value of native VLAN ID
        
        bad implementation
        
        use of hub
        
        host connected to a trunk link
        
        switch have access ports assigned to native VLAN
    - - Cisco IP phone can be configured to use two separate VLANs: one VLAN for voice traffic and another VLAN for data traffic
        from device attached to the phone
        
        link between switch, IP phone = trunk to carry both traffic (voice & data)
- - - - VLAN hopping
        
        enables traffic from one VLAN
        to be seen by another VLAN
      - due to incorrectly configured trunk port
      - attacker spoof itself as switch
        
        be capable to emulate
        802.1Q and DTP messages
        to make trunk between
        one fake switch and one real switch
      - prevent by turn off trunking on all ports
        
        on required trunking ports: disable
        DTP and manually enable trunking
    - - embed 802.1Q
        tag inside frame
      - works even if trunk
        ports are disabled
        
        because host send
        frame on not trunk link
    - - no traffic be forwarded at Layer 2 between ports on the same switch