What happens when an untagged frame is sent to a multiple untagged VLANs port

Why do people tell me not to use VLANs for security purposes?

There is real risks, if you don't fully understand the potential issues, and properly setup your network to mitigate the risk to a point that is acceptable for your environment. In many locations VLANs provide an adequate level of separation between between two VLANs.

Can someone please explain to me why the above isn't secure?

It sounds like you have taken all the basic steps needed to achieve a pretty secure setup. But I am not totally familiar with HP gear. You may have done enough for your environment.

A good article too look at would be the Cisco VLAN Security White Paper.

It includes a list of possible attacks against a VLAN-Based Network. Some of these are not possible on some switches, or can be mitigated by a proper design of the infrastructure/network. Take the time to understand them and decide if the risk is worth the effort it will take to avoid it in your environment.

Quoted from the article.

• MAC Flooding Attack
• 802.1Q and ISL Tagging Attack
• Double-Encapsulated 802.1Q/Nested VLAN Attack
• ARP Attacks
• Private VLAN Attack
• Multicast Brute Force Attack
• Spanning-Tree Attack

See also:

• http://hakipedia.com/index.php/VLAN_Hopping
• http://hakipedia.com/index.php/CAM_Table_Overflow
• http://etutorials.org/Networking/lan+switching/Chapter+9.+Switching+Security/VLAN-Based+Network+Attacks/

Indeed Trunks only carry tagged frames, the purpose of a trunk is to be able to transfer data from different VLAN's. When your frame reaches the other side, the switch will look at the tag and forward it to the correct VLAN.

A native VLAN is indeed a VLAN that carries untagged frames. However if you mean by control traffic the management VLAN, it's by default on VLAN1 just like the native VLAN, however you can configure a seperate VLAN for management traffic (which is best practice). But it's indeed also untagged.

Also if a port get's a VLAN tag it doesn't know, it's automatically placed on the native VLAN.