Setup VLAN agnostic ports on HP ProCurve 1810G (Ingress Filter, Trunking)

Why do people tell me not to use VLANs for security purposes?

There is real risks, if you don't fully understand the potential issues, and properly setup your network to mitigate the risk to a point that is acceptable for your environment. In many locations VLANs provide an adequate level of separation between between two VLANs.

Can someone please explain to me why the above isn't secure?

It sounds like you have taken all the basic steps needed to achieve a pretty secure setup. But I am not totally familiar with HP gear. You may have done enough for your environment.

A good article too look at would be the Cisco VLAN Security White Paper.

It includes a list of possible attacks against a VLAN-Based Network. Some of these are not possible on some switches, or can be mitigated by a proper design of the infrastructure/network. Take the time to understand them and decide if the risk is worth the effort it will take to avoid it in your environment.

Quoted from the article.

• MAC Flooding Attack
• 802.1Q and ISL Tagging Attack
• Double-Encapsulated 802.1Q/Nested VLAN Attack
• ARP Attacks
• Private VLAN Attack
• Multicast Brute Force Attack
• Spanning-Tree Attack

See also:

• http://hakipedia.com/index.php/VLAN_Hopping
• http://hakipedia.com/index.php/CAM_Table_Overflow
• http://etutorials.org/Networking/lan+switching/Chapter+9.+Switching+Security/VLAN-Based+Network+Attacks/

LACP is the Link Aggregation Control Protocol. It is all about setting up link aggregation automatically and dynamically whenever more than one link is available and the other side speaks LACP as well. It typically is used with redundant server-switch interconnection since a static setup with link aggregation would break server connectivity as long as the NIC drivers (where link aggregation is implemented) have not been loaded, thus effectively breaking pre-boot server management or network boot capabilities.

For switch interconnects, usually a static setup is preferred - although I would consider it purely a matter of taste.

"Link aggregation" and "trunking" are usually used as synonyms. There is a defined IEEE standard for LA (802.3ad) and many proprietary vendor extensions have arisen before standardization, most of which have implementations even in newer switch models for backward compatibility reasons.

If you set up a link aggregation or trunk group (LAG/TG), you should define the same VLANs as members of the group for switches on both sides. You only should define more than one path (i.e. more than one LAG interconnection) between two switches if you a) know exactly what you are doing and b) have enabled STP on both connected switches.

If you just suspect a bandwidth bottleneck, use the port statistics counters of your switches to verify it - quite possible that the bandwidth usage will turn out fine and your problem is an entirely different one. Mostly, switches do have rather slow CPUs and fast ASICs able to do most of the processing without any burden on the CPU. Some operations still would eat CPU cycles, one that is quite "popular" is the reception of broadcasts or multicast packets. If your network is generating a lot of broadcast/multicast traffic, processing and discarding the packets itself might saturate the CPU of a switch beyond reason. Again, check the counters to see if an excessive number of broadcasts is seen on the net.