ccna 7.0 book

ccna 7.0 book.Using VLAN technology, switch ports and the users connected to it can be grouped into logically defined groups, such as colleagues in the same department, cross-departmental teams, or different groups of users sharing the same network application. A VLAN can exist on a single switch or across multiple switches in a domain. A VLAN can include hosts within a single building or hosts within multiple buildings. VLANs can likewise be connected across a metropolitan area network.There are many different types of VLAN attacks in modern switched networks. More important than listing all the types of attacks is understanding the general methodology behind these attacks and the main ways to mitigate them.6.2.6.2 VLAN Hopping AttacksThe VLAN architecture not only simplifies network maintenance and improves performance, but it also opens the door to abuse. With the help of routers, VLAN hopping allows traffic from one . Traffic from one VLAN can be seen by other VLANs. In some cases, attackers can sniff data and extract passwords and other sensitive information. This attack is accomplished by configuring incorrect trunk (Trunk) ports. By default, trunk ports have access to all VLANs and pass traffic from multiple VLANs over the same physical link, which is typically between switches. Data transmitted across these links may be encapsulated using IEEE 802.1Q or inter-switch links (ISLs).In a basic VLAN hopping attack, the attacker takes advantage of the default auto-trunking configuration on most switches. The network attacker disguises himself as a switch by configuring the system. This spoofing requires that the network attacker be able to emulate ISL or 802.1Q signaling and Cisco's proprietary Dynamic Trunking Protocol (DTP). By spoofing a switch into thinking that the attacker is another switch that requires trunking (Trunk), the attacker can then gain access to all VLANs allowed on the trunk port. This attack requires configuration on the port to support auto or dynamic trunking mode to be successful. Eventually, the attacker becomes a member of all VLANs trunked on the switch and is able to jump, in other words, send and receive traffic across all VLANs±.VLAN hopping attacks can be launched in two ways.Spoofing DTP messages from the attacking host causes the switch to enter trunking mode. From there, the attacker can send traffic tagged as the target VLAN, and the switch then forwards the data table to its destination.Introduce a fraudulent (rogue) switch and enable trunking configuration. The attacker can then pass all VLANs on the fraudulent switch to the victim switch o6.2 Layer 2 Security Considerations 161The best way to protect against basic VLAN hopping attacks is to turn off trunking on all ports, except for ports that specifically require trunking. On ports that require trunking, disable DTP negotiation (autotrunking) and enable trunking configuration manually.