I'm having some difficulty understanding when people say that VLANS provide security by logically separating/dividing the switch into different sections after trunking the VLANs on a router and allowing the hosts on the different VLANs to communicate with each other. I can see how they would provide security if the VLANS could not communicate with each other but I'm struggling to understand what would be the purpose in allowing these VLANs to communicate with each other via a router instead of keeping them separate.
2 Answers
Some attacks are prevented by VLANs regardless of what the router allows. Arp poisoning, for example, or broadcast-based attacks like DHCP hijacking. Two hosts segregated by a VLAN cannot attack each other in those manners.
However, for security the presumption is that the router will not allow everything, but will apply some access controls or NAT hiding between the two VLANs. In that event the router should be able to provide all the security that it could between two physical VLANs.
answered Mar 2, 2021 at 23:02
-
Thanks for clarifying! So the reason as to why VLANs are considered secure is the assumption that access control will be applied on the routers because if that weren't the case, the hosts could simply freely communicate between the VLANs Commented Mar 3, 2021 at 0:00
To add to gowenfawr's response -- you don't have to allow the hosts to communicate with each other when the switch is connected to the router. You could have the hosts in different subnets, different VLANs, and then route out to the Internet (or wherever on your network you want them to go).
The only way that the hosts on the different VLANs will communicate is if you configure the router to let them do that (assuming the hosts are on different subnets).
