VLANs (Virtual Local Area Networks)

VLANs (Virtual Local Area Networks) are a method of creating separate logical networks on the same physical network infrastructure. VLANs provide network segmentation, improved security, better traffic management, and simplified administration. Understanding VLANs is essential for network design, security architecture, and penetration testing—especially for bypassing network segmentation (VLAN hopping).

What You'll Learn

What VLANs are and why they're used
How VLANs work at Layer 2
VLAN tagging (802.1Q)
Access ports vs trunk ports
Inter-VLAN routing
VLAN security best practices
VLAN hopping attacks
Configuring VLANs on switches

What Is a VLAN?

A VLAN is a logical grouping of devices on separate Layer 2 networks, even though they may be physically connected to the same switch.

The Problem VLANs Solve:

Without VLANs:

One switch = One broadcast domain
All devices see each other's broadcasts
No logical separation

┌─────────────────────────────┐
│         Switch              │
├──┬──┬──┬──┬──┬──┬──┬──┬───┤
   │  │  │  │  │  │  │  │
  HR Sales IT Guest ...
  
All in same broadcast domain
Security: Low

With VLANs:

One switch = Multiple VLANs
Separate broadcast domains
Logical isolation

┌─────────────────────────────┐
│         Switch              │
├──┬──┬──┬──┬──┬──┬──┬──┬───┤
   │  │  │  │  │  │  │  │
  VLAN 10  VLAN 20  VLAN 30
  (HR)     (Sales)   (IT)
  
Each VLAN is isolated
Security: Better

Why Use VLANs?

1. Security

Segment sensitive data:

VLAN 10: Public WiFi
VLAN 20: Employee network
VLAN 30: Servers
VLAN 40: Management

Public WiFi cannot reach servers
Employees cannot reach management

2. Reduced Broadcast Traffic

Without VLANs:
- All broadcasts to all 200 devices
- Network congestion

With VLANs:
- VLAN 10: 50 devices (only they see broadcasts)
- VLAN 20: 50 devices
- VLAN 30: 50 devices
- VLAN 40: 50 devices
- Less congestion per VLAN

3. Simplified Management

Group by function, not location:
- All HR devices in VLAN 10 (even if in different rooms)
- All IT devices in VLAN 20
- All IoT devices in VLAN 30

Easy to apply policies per VLAN

4. Flexibility

Physical location doesn't matter:
- Device on Switch A, Port 5 → VLAN 10
- Device on Switch B, Port 12 → VLAN 10
- They're on the same logical network!

How VLANs Work

VLAN Tagging (802.1Q)

802.1Q adds a 4-byte VLAN tag to Ethernet frames.

Normal Ethernet Frame:
┌──────┬──────┬──────┬─────┬─────┐
│ Dst  │ Src  │ Type │Data │ FCS │
│ MAC  │ MAC  │      │     │     │
└──────┴──────┴──────┴─────┴─────┘

802.1Q Tagged Frame:
┌──────┬──────┬────────┬──────┬─────┬─────┐
│ Dst  │ Src  │ 802.1Q │ Type │Data │ FCS │
│ MAC  │ MAC  │  Tag   │      │     │     │
└──────┴──────┴────────┴──────┴─────┴─────┘
                 │
                 └─ VLAN ID (12 bits: 1-4094)

VLAN Tag Structure:

802.1Q Tag (4 bytes):
┌─────────┬─────┬───────────┬──────────────┐
│  TPID   │ PCP │    DEI    │   VLAN ID    │
│ 0x8100  │ 3b  │    1b     │    12 bits   │
└─────────┴─────┴───────────┴──────────────┘

TPID: Tag Protocol Identifier (0x8100)
PCP: Priority Code Point (QoS)
DEI: Drop Eligible Indicator
VLAN ID: 1-4094 (0 and 4095 reserved)

VLAN Port Types

Access Port

Connects to end devices (computers, phones, printers).

Characteristics:
- Belongs to ONE VLAN
- Removes VLAN tag when sending to device
- Adds VLAN tag when receiving from device
- Device unaware of VLAN

Example:
Port 5 = Access port in VLAN 10
PC connected → All traffic is VLAN 10

Configuration (Cisco):

interface GigabitEthernet0/5
 switchport mode access
 switchport access vlan 10

Trunk Port

Connects switches or to routers/servers that need multiple VLANs.

Characteristics:
- Carries traffic for MULTIPLE VLANs
- Keeps VLAN tags (802.1Q)
- Allows VLANs to span switches
- Used between network devices

Example:
Switch A ←─Trunk─→ Switch B
Carries VLAN 10, 20, 30, 40

Configuration (Cisco):

interface GigabitEthernet0/1
 switchport mode trunk
 switchport trunk allowed vlan 10,20,30,40
 switchport trunk native vlan 1

Visual:

┌──────────────┐                ┌──────────────┐
│   Switch A   │                │   Switch B   │
│              │                │              │
│  Access  Trunk──────Trunk─────Trunk  Access │
│  Ports   Port                 Port   Ports  │
└───┬┬┬┬──────┘                └──────┬┬┬┬───┘
    ││││                              ││││
   Devices                          Devices
   (no tags)                        (no tags)
    
Access ports: Untagged traffic to devices
Trunk port: Tagged traffic between switches

Native VLAN

The native VLAN is the VLAN for untagged traffic on a trunk port.

Purpose:
- Legacy compatibility (devices that don't understand 802.1Q)
- Default VLAN 1 (by default)

Security note:
- Change from default VLAN 1
- Use a dedicated, unused VLAN
- Prevents VLAN hopping attacks

Example:

Trunk port receives untagged frame:
→ Assumes it belongs to native VLAN

Trunk port sends frame in native VLAN:
→ Sends untagged (removes tag)

VLAN Configuration Example

Scenario:

Create 3 VLANs:
- VLAN 10: Sales
- VLAN 20: Engineering
- VLAN 30: Guest WiFi

Ports:
- Gi0/1-10: VLAN 10 (Sales)
- Gi0/11-20: VLAN 20 (Engineering)
- Gi0/21-24: VLAN 30 (Guest)
- Gi0/48: Trunk to another switch

Cisco Configuration:

! Create VLANs
vlan 10
 name Sales
vlan 20
 name Engineering
vlan 30
 name Guest
exit

! Configure access ports for VLAN 10
interface range GigabitEthernet0/1-10
 switchport mode access
 switchport access vlan 10
 spanning-tree portfast
exit

! Configure access ports for VLAN 20
interface range GigabitEthernet0/11-20
 switchport mode access
 switchport access vlan 20
 spanning-tree portfast
exit

! Configure access ports for VLAN 30
interface range GigabitEthernet0/21-24
 switchport mode access
 switchport access vlan 30
 spanning-tree portfast
exit

! Configure trunk port
interface GigabitEthernet0/48
 switchport mode trunk
 switchport trunk allowed vlan 10,20,30
 switchport trunk native vlan 999
exit

Verification:

! Show VLANs
show vlan brief

! Show trunk ports
show interfaces trunk

! Show specific interface
show interfaces GigabitEthernet0/5 switchport

Inter-VLAN Routing

Problem: Devices in different VLANs cannot communicate (by design).

Solution: Inter-VLAN routing via router or Layer 3 switch.

Method 1: Router on a Stick

One router interface with subinterfaces:

┌────────┐
│ Router │
│  Gi0/0 │
└────┬───┘
     │ Trunk (VLANs 10, 20, 30)
     │
┌────┴────┐
│ Switch  │
│ VLANs:  │
│ 10,20,30│
└─────────┘

Router has subinterfaces:
- Gi0/0.10 → VLAN 10 (192.168.10.1/24)
- Gi0/0.20 → VLAN 20 (192.168.20.1/24)
- Gi0/0.30 → VLAN 30 (192.168.30.1/24)

Router Configuration (Cisco):

interface GigabitEthernet0/0
 no shutdown
exit

interface GigabitEthernet0/0.10
 encapsulation dot1Q 10
 ip address 192.168.10.1 255.255.255.0
exit

interface GigabitEthernet0/0.20
 encapsulation dot1Q 20
 ip address 192.168.20.1 255.255.255.0
exit

interface GigabitEthernet0/0.30
 encapsulation dot1Q 30
 ip address 192.168.30.1 255.255.255.0
exit

Method 2: Layer 3 Switch (SVI)

Switch does routing between VLANs:

Switch (Layer 3):
- VLAN 10 Interface: 192.168.10.1/24
- VLAN 20 Interface: 192.168.20.1/24
- VLAN 30 Interface: 192.168.30.1/24
- Routes between VLANs

Configuration (Cisco):

! Enable routing
ip routing

! Create VLAN interfaces (SVIs)
interface vlan 10
 ip address 192.168.10.1 255.255.255.0
 no shutdown
exit

interface vlan 20
 ip address 192.168.20.1 255.255.255.0
 no shutdown
exit

interface vlan 30
 ip address 192.168.30.1 255.255.255.0
 no shutdown
exit

VLAN Security Best Practices

1. Change Default VLAN

! Don't use VLAN 1 (default)
! Create new management VLAN
vlan 99
 name Management

! Disable VLAN 1
interface vlan 1
 shutdown

2. Disable Unused Ports

! Shutdown unused ports
interface range GigabitEthernet0/25-47
 shutdown
 switchport mode access
 switchport access vlan 999  ! Unused VLAN

3. Use Dedicated Native VLAN

! Don't use VLAN 1 as native
! Use dedicated, unused VLAN
vlan 999
 name Native-Unused

interface GigabitEthernet0/48
 switchport trunk native vlan 999

4. Explicitly Set Allowed VLANs

! Don't allow all VLANs
! Specify only needed ones
interface GigabitEthernet0/48
 switchport trunk allowed vlan 10,20,30
 ! Not: switchport trunk allowed vlan all

5. Enable Port Security

interface GigabitEthernet0/5
 switchport port-security
 switchport port-security maximum 2
 switchport port-security mac-address sticky
 switchport port-security violation shutdown

VLAN Attacks

1. VLAN Hopping (Switch Spoofing)

Attack: Attacker configures device as trunk port.

Normal:
Attacker → Access port (VLAN 10 only)

Attack:
Attacker → Sends DTP (Dynamic Trunking Protocol)
Switch → "Oh, it's a trunk!" → Negotiates trunk
Attacker → Now has access to all VLANs!

Execution:

# Using Yersinia
yersinia -G  # GUI mode
# Select DTP, send trunk negotiation

# Or with custom scripts
# Force switch to trunk mode

Defense:

! Disable DTP (Dynamic Trunking Protocol)
interface GigabitEthernet0/5
 switchport mode access
 switchport nonegotiate  ! Disable DTP

2. Double Tagging Attack

Attack: Exploit native VLAN to hop to another VLAN.

Attacker in VLAN 1 (native) wants to access VLAN 10:

1. Creates packet with TWO 802.1Q tags:
   [Frame][Tag: VLAN 1][Tag: VLAN 10][Data]

2. Sends to switch
3. Switch removes outer tag (VLAN 1, native)
4. Forwards frame with inner tag (VLAN 10)
5. Frame arrives in VLAN 10!

Requirements:

Attacker in native VLAN
Native VLAN is VLAN 1 (or known)
Trunk port carries target VLAN

Defense:

! Use dedicated, unused native VLAN
interface GigabitEthernet0/48
 switchport trunk native vlan 999  ! Not VLAN 1

! Don't use native VLAN for user traffic
vlan 999
 name Native-Unused

3. VLAN Hopping via DTP

Attack: Exploit Dynamic Trunking Protocol.

Attacker sends DTP packets:
"I'm a switch, let's trunk!"

Vulnerable switch:
"OK!" → Forms trunk
Attacker → Access to all VLANs

Defense:

! Disable DTP globally
no cdp enable  ! Also disable CDP

! Per interface
interface range GigabitEthernet0/1-47
 switchport mode access
 switchport nonegotiate

VLAN Tools and Analysis

Wireshark:

Display filter for VLAN tagged traffic:
vlan

Specific VLAN:
vlan.id == 10

Verify VLAN tagging:
Look for 802.1Q in frame details

Linux VLAN Configuration:

# Load 8021q module
sudo modprobe 8021q

# Create VLAN interface
sudo ip link add link eth0 name eth0.10 type vlan id 10
sudo ip addr add 192.168.10.50/24 dev eth0.10
sudo ip link set eth0.10 up

# Remove VLAN interface
sudo ip link delete eth0.10

VLAN Hopping Tools:

# Yersinia (Layer 2 attacks)
sudo yersinia -G

# Scapy (craft packets)
from scapy.all import *
packet = Ether()/Dot1Q(vlan=10)/IP(dst="192.168.10.1")/ICMP()
sendp(packet)

# frogger (VLAN hopping)
# Double tagging attack tool

Try It Yourself

Exercise 1: View VLANs (if you have managed switch)

! Connect to switch via console or SSH
enable
show vlan brief

! Output shows:
! - VLAN ID
! - Name
! - Status
! - Ports assigned

Exercise 2: Create VLAN on Linux

# Create VLAN 10 on eth0
sudo ip link add link eth0 name eth0.10 type vlan id 10

# Assign IP
sudo ip addr add 192.168.10.100/24 dev eth0.10

# Bring up
sudo ip link set eth0.10 up

# Test
ping 192.168.10.1  # Gateway in VLAN 10

# View
ip addr show eth0.10

# Cleanup
sudo ip link delete eth0.10

Exercise 3: Capture VLAN Traffic

# Capture on trunk port with Wireshark
sudo wireshark

# Filter: vlan

# Observe:
# - VLAN IDs in packets
# - 802.1Q headers
# - Which VLANs are active

Exercise 4: Lab Setup (GNS3/Packet Tracer)

Create topology:
- 1 Switch (or 2 switches with trunk)
- 3 VLANs
- 1 Router for inter-VLAN routing
- Test connectivity within VLANs
- Test routing between VLANs

Quick VLAN Reference

# Create VLAN
vlan 10
 name Sales
exit

# Access port
interface GigabitEthernet0/5
 switchport mode access
 switchport access vlan 10

# Trunk port
interface GigabitEthernet0/48
 switchport mode trunk
 switchport trunk allowed vlan 10,20,30
 switchport trunk native vlan 999
 switchport nonegotiate

# View VLANs
show vlan brief
show vlan id 10
show interfaces trunk

# Inter-VLAN routing (Layer 3 switch)
ip routing
interface vlan 10
 ip address 192.168.10.1 255.255.255.0
 no shutdown

Common VLAN IDs

VLAN 1:    Default (don't use)
VLAN 10:   Management
VLAN 20:   Users/Employees
VLAN 30:   Guest WiFi
VLAN 40:   Servers
VLAN 50:   VoIP
VLAN 60:   IoT/Building automation
VLAN 99:   Native VLAN (unused)
VLAN 999:  Blackhole (unused ports)

Note: Use what makes sense for your org

Resources

Tools:

Wireshark: Analyze VLAN traffic
Yersinia: Layer 2 attacks (VLAN hopping)
GNS3/Packet Tracer: Practice VLAN configuration
Scapy: Craft VLAN-tagged packets

Reading:

Practice:

Set up VLANs in home lab
Configure inter-VLAN routing
Test VLAN hopping (lab only!)
Design VLAN architecture for organization

Next Steps

Master VLAN configuration on switches
Implement inter-VLAN routing (router on a stick, Layer 3 switch)
Understand VLAN security (DTP, native VLAN, double tagging)
Practice VLAN hopping in a lab environment
Design VLAN architecture for network segmentation

VLANs are fundamental to modern network design and security. Master them to build secure, efficient networks!

"VLANs: Logical networks in a physical world. Segment wisely, secure thoroughly."