Is opting for VLAN security a wise choice?

Question

I have a network, where I have a couple of VLANS. There is a firewall between the 2 VLANs. I am using HP Procurve switches and have made sure that switch-to-switch links accept tagged frames only and that host ports don't accept tagged frames (They are not "VLAN Aware"). I've also made sure that the trunk ports don't have a native VLAN. I've also enabled "Ingress Filtering". Furthermore, I've made sure that host ports are only members of a single VLAN, which is the same as the PVID of the respective port. The only ports which are members of multiple VLANs are the trunk ports. Can someone please explain to me why the above isn't secure?

Amit Sinha · Accepted Answer

The major lack of security is down to the fact that although you are segregating from a logical perspective, you are actually running the networks across the same wires, so from the perspective of an attacker on one VLAN it is typically not much work to access the other VLAN.

This is why if, during a security audit, I find a management VLAN for routers running across the same network as userland VLAN it raises a big red flag.
The main reason organisations use VLAN security is that it is cheap as only one physical network needs to be implemented.
Physical segregation is the simplest solution, but does require more NICs, more wires etc.
Encryption (essentially turning the VLAN into a VPN) can also work, and isn't rocket science.

Is opting for VLAN security a wise choice?

About this question

Your answer

1 Answer

More Cyber Security discussions

Learn & Explore

Cyber Security Tutorials

Cyber Security Interview Q&A

Latest Cyber Security Blogs

Want answers to more Cyber Security questions?

Stay in the loop — it’s free

You’re on the list!