Cisco – Trying to understand why VLANs need to be created on intermediate switches

cisconetworking

I'm currently studying for the Cisco switching exam and having trouble understanding exactly how 802.1q tagging works.

Given three daisy chained switches (A,B, and C) with trunk ports between them and VLAN 101 defined on both end switches (A and C), I'm not sure why the VLAN also needs to be defined on the middle one (B)?

Note that I am not disputing that it does need to be configured, I'm just trying to understand why exactly.

As I understand it, traffic from VLAN 101 on switch A will be tagged as it goes through the trunk to switch B. According to the documentation I have read, trunks will pass all VLANs by default, and the .1q tag is only removed when the frame leaves through an access port on the relevant VLAN. From this I would expect switch B to simply forward the tagged frame unchanged through the trunk to switch C.

Can anyone shed some light on how switch B processes this frame and why it does not get forwarded through the other trunk ?

Best Answer

Trunking just gives an interface the ability to deal with tagged frames. It doesn't give it a general ability to handle all tags.

This is where the "default" or PVID (primary VLAN ID) comes in. When you set this, the switch treats all incoming packets with tags that it isn't explicitly configured to handle as if it was an untagged packet on the PVID. The frame is then handled with that in mind -- with the 802.1q tag removed.

You have to explicitly specify which VLANs are supported on which ports. This means you have to explicitly define and configure how the VLANs are forwarded through your mesh(*) of switches. Otherwise, all tagged packets could potentially go everywhere, leading to security problems and potential bottlenecks in terms of throughput.

(*) == originally typed as "mess", but that's often an appropriate sentiment.

Related Solutions

VLANs – Why Not to Use VLANs for Security

Why do people tell me not to use VLANs for security purposes?

There is real risks, if you don't fully understand the potential issues, and properly setup your network to mitigate the risk to a point that is acceptable for your environment. In many locations VLANs provide an adequate level of separation between between two VLANs.

Can someone please explain to me why the above isn't secure?

It sounds like you have taken all the basic steps needed to achieve a pretty secure setup. But I am not totally familiar with HP gear. You may have done enough for your environment.

A good article too look at would be the Cisco VLAN Security White Paper.

It includes a list of possible attacks against a VLAN-Based Network. Some of these are not possible on some switches, or can be mitigated by a proper design of the infrastructure/network. Take the time to understand them and decide if the risk is worth the effort it will take to avoid it in your environment.

Quoted from the article.

MAC Flooding Attack
802.1Q and ISL Tagging Attack
Double-Encapsulated 802.1Q/Nested VLAN Attack
ARP Attacks
Private VLAN Attack
Multicast Brute Force Attack
Spanning-Tree Attack

Cisco – vlan tagging on a cisco catalyst 3560

Once you've identified your exact requirements above:

Each VLAN needs to be created before traffic will pass:

Switch(config)# vlan [number]
Switch(config-vlan)# name [name]

For each trunk (>1 vlan) port, config as follows. Let's say 1000 is native (untagged) VLAN and 2000-2100 and 3000 are carried:

Switch(config)# int gi0/1
Switch(config-interface)# switchport mode trunk
Switch(config-interface)# switchport trunk allowed vlan 1000,2000-2100,3000
Switch(config-interface)# switchport trunk native vlan 1000

For each access (1 vlan, untagged) port, config as follows:

Switch(config)# int gi0/2
Switch(config-interface)# switchport mode access
Switch(config-interface)# switchport access vlan 1000

You can also specify and interface range: Switch(config)# int range gi0/1 - 10, gi1/1

And shorten commands if the keywords are still unique: Switch(config-interface)# sw tr na vl 1000

Best Answer

Related Solutions

VLANs – Why Not to Use VLANs for Security

Cisco – vlan tagging on a cisco catalyst 3560

Related Topic