ccna 7.0 bridging course

ccna 7.0 bridging course.6.2.6.3 VLAN Double Tagging AttacksAnother type of VLAN attack is the double-tagged (or double-encapsulated) VLAN hopping attack. This type of attack takes advantage of the way the switch hardwareof how it works. Most switches perform only one layer of 802.1Q decapsulation, which may allow an attacker in a given environment to embed hidden 802.1Qtag embedded in the data frame. This tag allows the data frame to enter a VLAN not specified by the initial 802.1Q tago double encapsulation VLAN hoppingAn important feature of the attack is that hosts are usually able to send data frames on a segment without a trunk link, even if the trunk port is disabled. The double-tagged VLAN hopping attack follows the following four steps. Step 1 The attacker sends a double-tagged 802.1Q data frame to the switch. The outer layer header has the attacker's VLAN tag and that tag is the same as the trunk port's intrinsic VLAN. In this example, it is assumed to be VLAN10o the inner layer tag is the victim VLAN, in this case VLAN20. step 2 The data frame arrives at the first switch, which looks at the first 4 bytes of the 802.1Q tag. The switch sees that this data frame is destined for VLAN 10, which is the victim VLANo The switch forwards the data frame through all VLAN 10 ports after stripping the VLAN 10 tag. The VLAN 10 tag is de-tagged at the trunk port and is not re-tagged because it is part of the intrinsic VLAN. At this point, the VLAN 20 tag is not affected in any way and is not inspected by the first switch. Step 3 The data frame arrives at the second switch, but that switch does not know that it should go to VLAN 10o because the 802.1Q specification states that intrinsic VLAN traffic does not have to be tagged by the sending switch.The second switch only sees the inner 802.1Q tag sent by the attacker and sees that the data frame is destined for VLAN 20, the target VLAN o The second switch sends the data frame to the victim port or floods it, depending on whether there is a MAC address table entry for the victim host.This type of type is unidirectional and the attack only works if the attacker is connected to a port that is in such a VLAN that is intrinsically VLAN-like to the trunk port. The idea behind this attack is that double tagging allows an attacker to send data to a host or server on a VLAN that is supposed to be blocked by some type of access control configuration; and that this return traffic will also be released, which allows the attacker to communicate with devices on the VLAN that would normally be blocked. Stopping this type of attack is not as easy as stopping a basic VLAN hopping attack. The best approach is to ensure that the intrinsic VLAN of the trunk port is different from the intrinsic VLAN of the user port. In fact, it is a security best practice to use dummy VLANs, i.e., to use the unused LANs in the switched LAN as all802.11 trunk's intrinsic VLANO6-3 Configuring Layer 2 Security6.3.1 Configuring Port Security