What are the security risks and challenges of vlan trunking and pruning and how do you mitigate them?

1 Spoofing attacks

One of the main security risks of VLAN trunking is spoofing attacks, where an attacker can send packets with a forged VLAN tag to access or disrupt other VLANs on the trunk. This can lead to data leakage, denial of service, or network compromise. To prevent spoofing attacks, you should use port security features on your switches, such as limiting the number of MAC addresses per port, enabling dynamic ARP inspection, or implementing 802.1X authentication. You should also use encryption and integrity checks on your trunk links, such as IPsec or MACsec.

2 Double tagging attacks

Another security risk of VLAN trunking is double tagging attacks, where an attacker can insert two VLAN tags in a packet to bypass the native VLAN on the trunk port and reach the target VLAN. This can allow the attacker to access or modify sensitive data or devices on other VLANs. To prevent double tagging attacks, you should avoid using the default VLAN 1 as the native VLAN on your trunk ports, as it is often untagged and vulnerable. You should also use a dedicated VLAN for your trunk ports, and disable any unused ports or VLANs on your switches.

3 VLAN hopping attacks

A related security risk of VLAN trunking is VLAN hopping attacks, where an attacker can exploit the switchport mode dynamic auto or desirable feature on a trunk port to negotiate a trunk link with another device and access other VLANs on the network. This can enable the attacker to perform reconnaissance, man-in-the-middle, or spoofing attacks on other VLANs. To prevent VLAN hopping attacks, you should use the switchport mode trunk command to manually configure your trunk ports, and use the switchport nonegotiate command to disable the dynamic trunking protocol. You should also use the switchport trunk allowed vlan command to restrict the VLANs that can be carried on the trunk.

4 Pruning errors

One of the main challenges of VLAN pruning is pruning errors, where a network engineer can accidentally remove a VLAN from a trunk port that is needed by a device or application on the network. This can cause connectivity issues, performance degradation, or service disruption. To avoid pruning errors, you should use a consistent and documented naming convention for your VLANs, and use the show vlan and show interfaces trunk commands to verify your pruning configuration. You should also use a network management tool, such as Cisco Prime Infrastructure, to monitor and troubleshoot your VLAN pruning.

5 Pruning attacks

Another challenge of VLAN pruning is pruning attacks, where an attacker can manipulate the VLAN database on a switch to remove or add VLANs from a trunk port, or change the native VLAN on a trunk port. This can create security holes, traffic loops, or network instability. To prevent pruning attacks, you should use the vtp mode transparent command to disable the VLAN trunking protocol on your switches, and use the vtp password command to protect the VTP domain with a secret password. You should also use the vlan dot1q tag native command to tag the native VLAN on your trunk ports, and use the vlan access-map command to filter the traffic on your trunk ports.

6 Pruning optimization

A final challenge of VLAN pruning is pruning optimization, where a network engineer can improve the efficiency and security of the network by removing unnecessary or redundant VLANs from the trunk ports. This can reduce the bandwidth consumption, broadcast domain size, and attack surface on the network. To optimize your pruning configuration, you should use the show spanning-tree summary command to identify any blocked or unused ports on your switches, and use the switchport trunk pruning vlan command to exclude them from the trunk. You should also use the show vtp status command to check the revision number and prune-eligible status of your VLANs, and use the vtp pruning command to enable or disable pruning on your VTP domain.

7 Here’s what else to consider

This is a space to share examples, stories, or insights that don’t fit into any of the previous sections. What else would you like to add?