Avoid VLAN Virtual Network Vulnerabilities to the maximum extent (1)

A vswitch is not designed as a security device, but is still designed to improve network performance. If you want to add a vswitch to the security mechanism, make sure that you configure the vswitch correctly, second, the switch manufacturer must fully understand and fully implement the basic standards of the switch software.

If you have strict requirements on network security and do not use shared switches, you should use dedicated switches to Ensure network security. If a vswitch must be shared between untrusted networks and trusted users, only security disasters can be caused.

VLAN does make it possible to isolate network services. These services share the same switch or even a group of switches. However, when the vswitch designer adds this isolation feature to the product, it is not a security issue. VLAN is used to restrict and filter broadcast business traffic. Unfortunately, VLAN relies on software and configuration mechanisms rather than hardware to complete this task.

In recent years, some firewalls have become VLAN devices, which means that packet label-based rules can be developed to transfer a packet to a specific VLAN. However, the firewall, as a VLAN device, also adds a lot of flexible rules for website hosting. In this way, the labels on which the firewall depends are not designed based on security. Devices outside the vswitch can also generate tags that can be easily attached to packets to fool the firewall.

How does a VLAN work? What security advantages does a VLAN have? How can we avoid VLAN vulnerabilities to the maximum extent if we decide to use VLAN as part of the security system?

Partition Function 　

The term "Switch" was first used to describe such a device, which exchanges network services between network interfaces called "ports. Recently, a LAN switch was called a bridge ". Now, even the IEEE standards related to switches inevitably use the term "bridge.

The bridge is used to connect different segments on the same LAN. The LAN here refers to a local network that does not need to be routed. The bridge software detects the MAC address contained in the received packet to determine which port is connected to which network device. Initially, the bridge sends all received data packets to each port. After a period of time, the bridge learns how to send data packets to the correct network interface by establishing a spanning tree and table. These spanning trees and tables map MAC addresses to ports by selecting correct network interfaces and avoiding loop algorithms. By sending data packets to the correct network interface, the bridge reduces network business traffic. The bridge can be considered as a highway connecting two different roads, and only the necessary traffic between the two roads can be used on the highway.

Although the bridge reduces network service traffic, the network can run more efficiently. The bridge still needs to send broadcast data packets to all ports. In any LAN, a message broadcast is sent to all systems in the LAN. ARP Address Resolution Protocol) is an example of broadcast information.

As the number of ports and the number of additional management software increases, the functionality of the bridge device becomes stronger and stronger. A new function is introduced: the bridge has the partition function and can be divided into multiple virtual bridges. When Partitioning in this way, the broadcast information will be restricted to those ports with the virtual bridge and the corresponding VLAN, rather than being sent to all ports.

Limiting broadcast in a VLAN does not prevent the system in a VLAN from accessing the system connected to the same bridge and belongs to a different VLAN. However, remember that ARP broadcasts are used to obtain the MAC address corresponding to a specific IP address. Without a MAC address, machines in the same network cannot communicate with each other.

The Cisco website describes two scenarios where packets can be transmitted in a VLAN connected to the same vswitch. In the first case, the system establishes a TCP/IP connection in the same VLAN, and then the switch is reset so that the port of one switch belongs to another VLAN. The communication will continue because both parties have the MAC address of the other side in their ARP buffer, so that the bridge will know which port the target MAC address directs. In the second case, someone wants to manually configure a VLAN to create a static ARP entry for the system to be accessed. This requires him to know the MAC address of the target system. He may need to directly access the target system physically.

The problems described in both cases can be improved by using vswitch software, which is used to eliminate the information required for data packets during transmission. In a Cisco high-end switch, the Spanning Tree of each VLAN is separated. Other switches either have similar characteristics or can be set to filter the bridging information of members in each VLAN.

Link Aggregation 　

Multiple vswitches can share the same VLAN through the configuration mechanism and the labels for exchanging data packets between vswitches. You can set a vswitch to make one of the ports a link and transmit packets to any VLAN on the link. When a data packet is transmitted between switches, each data packet is tagged Based on the 802.1Q protocol. 802.1Q protocol is an IEEE standard for data packets transmitted between bridges. The receiving switch removes the packet label, sends the packet to the correct port, or sends the packet to the correct VLAN when the packet is a broadcast packet.

These four-byte long 802.1Q are appended to the Ethernet packet header, followed by the source address. The first two bytes contain 81 00, which is an 802.1Q tag protocol type. The last two bytes contain a possible priority, a flag, and a 12-bit VIDVLAN Identifier ). The VID value ranges from 0 to 4095, and both 0 and 4095 are reserved. The default value of VID is 1, which is also the default value of the unspecified port of the switch configured for the VLAN.

According to the default configuration of the Cisco switch, link aggregation is recommended. If one port finds that another switch is connected to this port, this port can negotiate the link aggregation. The default link port belongs to vlan1. this VLAN is called the local VLAN of this port. The administrator can specify the link port to any VLAN.

You can set the link port to prevent packet transmission between VLANs. You can set the local vlan of the link port to a VID different from any other VLAN. Remember that the default local vlan of the link port is VID 1. You can set the local vlan of the link port to 1001, or the value that any switch allows and is not used by any other VLAN.