By default, in order for users in different VLANs to communicate, inter-VLAN routing must be employed. This can be done using a one-armed-router, also referred to as a router-on-a-stick, by using sub-interfaces on the router. Alternatively, and more commonly, Multilayer switches, such as the Cisco Catalyst 3750, 4500, and 6500 series switches, are used in the network. These switches have the capability to both route and switch. Inter-VLAN routing is a core concept and will be described in detail later in this guide.
VLAN hopping attacks are methods in which an attacker attempts to bypass a Layer 3 device to communicate directly between VLANs, with the main objective being to compromise a device residing on another VLAN. There are two primary methods used to perform VLAN hopping attacks, as follows:
- Switch spoofing
- Double-tagging
Switch Spoofing Attacks
In switch spoofing, the attacker impersonates a switch by emulating ISL or 802.1Q signaling, as well as Dynamic Trunking Protocol (DTP) signaling. DTP provides switches with the ability to negotiate the trunking method for the trunk link they will establish between themselves.
If an attacker can successfully emulate a trunk, the attacker’s system becomes a member of all VLANs, since trunk links forward all VLAN information by default. Switch spoofing attacks attempt to exploit the default native VLAN (VLAN 1) that is used on Cisco Catalyst switches.
By default, when an access port sends a frame to a remote switch, and that packet is encapsulated into 802.1Q format with the native VLAN ID, it will be successfully forwarded to the remote switch without the need to cross a Layer 3 device. Network administrators can prevent switch spoofing attacks by performing the following actions:
-
Disabling the DTP on trunk ports by issuing the switchport nonegotiate interface configuration command on trunk links;
-
Disabling trunking capability on ports that should not be configured as trunk links by statically configuring them as access ports using the switchport mode access interface configuration command on all non-trunk links; and
-
Preventing user data from traversing the native VLAN by specifying a VLAN other than VLAN 1, which does not span the entire Layer 2 network. For example, VLAN 5 could be configured as the native VLAN for a trunk using the switchport trunk native vlan 5 and the switchport trunk allowed vlan remove 5interface configuration commands.
Double-Tagging Attacks
By default, traffic in the native VLAN using 802.1Q trunks is not tagged as frames travel between switches in the Layer 2 switched network. This default behavior means that if an attacker resides on the native VLAN used by the switches, the attacker could successfully launch a double-tagging network attack.
Double-tagging or double-encapsulated VLAN attacks involve tagging frames with two 802.1Q tags in order to forward the frames to a different VLAN. The embedded hidden 802.1Q tag inside the frame allows the frame to traverse a VLAN that the outer 802.1Q tag did not specify. This is a particularly dangerous attack because it will work even if the trunk port is set to off.
The first switch that encounters the double-tagged frame strips off the first tag and forwards the frame. This results in the frame being forwarded with the inner 802.1Q tag out of all ports on the switch, including the trunk ports configured with the native VLAN ID of the network attacker. The second switch then forwards the frame to the destination based on the VLAN identifier in the second 802.1Q header. This double-tagging concept is illustrated below in Figure 6-10:
Fig. 6-10. Double-Tagging Attacks
As illustrated in Figure 6-10, an attacker has compromised Host 1 and is trying to access Host 2. The attacker sends a double-tagged frame to Switch 1, which includes the native VLAN (VLAN 1), and the VLAN Host 2 resides in, which is VLAN 200.
When Switch 1 receives the frame, it strips off the first tag and forwards the frame to Switch 2. When Switch 2 receives the frame, it contains only VLAN 200. The switch removes this tag and forwards the frame to Host 2, which resides in VLAN 200. The attacker has successfully managed to traverse the two different VLANs while bypassing any Layer 3 network devices.
To prevent double-tagging attacks, administrators should ensure that the native VLAN used on all the trunk ports is different from the VLAN ID of user access ports. It is best to use a dedicated VLAN that is specific for each pair of trunk ports and not the default VLAN. In addition to this, configuring the native VLAN to tag all traffic prevents the vulnerability of double-tagged 802.1Q frames hopping VLANs. This functionality can be enabled by issuing thevlan dot1q tag native global configuration command.