Questions tagged [vlans]
The vlans tag has no usage guidance.
42 questions
0
votes
0
answers
98
views
Network Segmentation - Single Firewall VM vs Multiple
I am currently implementing a new network with different segments. The separation of those segments is achieved using VLANs. To enable some segments to communicate with each other and to be reached ...
- 1
0
votes
1
answer
1k
views
VLANs for public and private network segregation
I saw a network setup recently that looked like the following:
The ISP provides two static public IPs on a specific VLAN and one is used for an internet network and the other for a server exposed to ...
- 237
1
vote
2
answers
343
views
How are VLANS logically separating a switch?
I'm having some difficulty understanding when people say that VLANS provide security by logically separating/dividing the switch into different sections after trunking the VLANs on a router and ...
- 13
1
vote
1
answer
203
views
What is the threat/risk difference in opening multiple ports on one physical NIC on a home server vs creating VLANs and opening ports on each VLAN?
I have a single home server with a single NIC. I intend to run numerous services -- some will be internet exposed, some will not. I don't know if I am going to run them as VMs or Docker container but ...
- 155
0
votes
1
answer
625
views
What are the security issues can be exploited to VLAN switches to compromise network?
While VLAN switches can be used to provide security between network segments using VLAN filtering rules. Is there any possibility to have an security issue which is exploited to VLAN switches?
1
vote
1
answer
364
views
Local Scans initiated from a VLAN Broadcast IP address
Just reviewing some logs and I am seeing local scans to several local IP addresses on port 137 within my network. The source IP however is the broadcast IP of the VLAN (.255).
I have checked the ...
0
votes
1
answer
290
views
micro segmentation in the campus [closed]
We have so many devices (IoT and wintel, macs, androids, ios) spread across a few VLANs. Worried about any one device getting affected (e.g. Ransomware) and potentially infecting all other devices on ...
- 3
1
vote
0
answers
230
views
Are VLANs necessary to segment WiFi SSID to secure traffic?
WiFi routers offer the ability to configure multiple SSIDs. Equally some routers also enable the option to configure virtual networks (VLANs).
If the requirement is to secure WiFi traffic such that ...
- 1,513
1
vote
1
answer
1k
views
What are the risks resulting from having a switch without strong access control directly facing the Internet?
At home I have a connection to my provider via glass fiber that provides two VLANs: IPTV and Internet.
The structure of the network is exactly as shown in the following image, except for the phone ...
- 343
-2
votes
1
answer
488
views
Create 2 separate networks at home [closed]
I am looking to increase the security of my home network as much as possible.
An option I came across was to create two home networks. One would be used by less secure devices, and another for more ...
- 343
3
votes
2
answers
211
views
Is switching protocols a security measure worth implementing?
We deploy our internet facing applications in multiple vlans and there is a rule that talking from one vlan to the next has to be done in another protocol or an other implementation of the protocol.
...
- 131
0
votes
1
answer
1k
views
Are there risks in not having a edge firewall? [duplicate]
I am currently working with a client that has all their external traffic going through the core switch and then is being passed to the router and back through the core switch and then to the rest of ...
- 846
5
votes
1
answer
561
views
VLAN Device Isolation - Feasibility
To mitigate the risk of malware propagating through a network, how reasonable is it to place each and every device on its own VLAN (complete isolation)?
Note:
The devices do not need to communicate ...
- 155
3
votes
1
answer
2k
views
Are Cisco switches vulnerable to VLAN hopping?
Are Cisco switches vulnerable to VLAN hopping? We use Layer 2+ and Layer 3 switches in a hardened environment. They are IE-3000 and IE-4000 series switches.
We want to perform a vulnerability scan ...
- 391
3
votes
1
answer
4k
views
Should a backup server be on a separate subnet / vlan from other machines on the network?
Should a backup server be on a separate VLAN/subnet from the systems it backs up? And should the routes only go one way from inside the VLAN/subnet of the backup server out to the clients and subnets ...
- 1,471
1
vote
1
answer
2k
views
Is VLAN Hopping through switch spoofing possible without DTP?
I've been reading about Switch Spoofing for some homework, and found that the attack is based on Cisco DTP protocol.
In case I want to replicate the attack in class, I would use HP switch 2510 from ...
- 113
1
vote
2
answers
1k
views
Why double tagging attack in VLAN is unidirectional (one way)?
I was reading this article about VLAN double tagging security issues, and started to wonder two things:
1) Why double tagging is a one way attack?
2) How can the adversary make a bi-directional ...
- 113
0
votes
1
answer
326
views
Attacking (or even pinging) a device over a network on different VLAN
If a firewall is configured with different VLANs, how could an attacker perform an attack over a different VLAN. I see a lot of information on scanning, exploiting, and other attacking methods using a ...
- 1,300
2
votes
1
answer
348
views
VLANs, Subnets and a sensitive database server
I have a sensitive database, and two categories of employees Category A and Category B. Category A does not require access to the sensitive database while category B does require access to the ...
- 1,102
1
vote
1
answer
136
views
Default GW IP address shared with management interface IP: any securirty implications?
Building out separate VLAN for management interfaces.
The proposition is to use Default GW IP address as a management interface for network device.
Any security concerns?
- 13
6
votes
4
answers
850
views
Building an info sec VM lab - safe to keep on my home network?
I'm a new member making my first post here. I had a very quick, and admittedly basic, question. I'm setting up an info sec lab for the first time at home. I'm trying to build some more technical ...
- 61
2
votes
1
answer
325
views
Linux (!) Network Architecture for CTF-scenario [closed]
My boss recently enrolled me in an InfoSec training. I am part of the network team, but have limited experience in InfoSec.
My first assignment is to draw a layout of a network that will be used ...
- 31
0
votes
1
answer
622
views
Network security from the inside
Yesterday I heard some people talking about not allowing users to RDP into servers they shouldn't and such which got me thinking about my companies network and the security of it.
Can someone point ...
- 101
1
vote
1
answer
4k
views
How separated should a management VLAN be from the production VLAN?
I was after a little bit of advice regarding Network Management.
Users will enter the network and hit a remote desktop server. On from this, they will pass through firewalls to the core switch. When ...
- 13
3
votes
1
answer
803
views
Security criteria for selecting a network switch?
I am looking to purchase a switch with 24+ ports. The set of security
criteria that I should bear in mind when selecting a switch is not
clear to me.
I have tried to take other networking security ...
- 403
0
votes
0
answers
474
views
HIPAA requirements for local server
I am looking to create a ePHI database for a small physical therapy office and I would like some advice on some of the security that I will need to implement.
Most computers will most likely have no ...
1
vote
0
answers
120
views
Mysql Virtual IP and timeout
What are the risk that I encounter when increasing the timeout of a vip between a web server (apache) and mysql cluster (two servers). Actually it is set to 5 minutes.
If time_out was 1hour, knowing ...
- 181
4
votes
2
answers
2k
views
Bypassing Trustwave NAC
I'm currently doing a penetration test for a client, who are using Trustwave NAC to prevent unauthorized physical access to their network.
I would like to know if there are any possible ways to ...
- 3,606
2
votes
2
answers
2k
views
ASA5505 DMZ issue [closed]
I have ASA5505 , connected to the WAN on port 0 (called Vlan2), and connected to my development LAN on port 7 (Called Vlan1).
I want to add DMZ, and I connected switch and servers to port 3, and ...
- 163
0
votes
1
answer
1k
views
Are there any free, premade penetration testing labs? [duplicate]
I've already assembled a lab consisting of Kali, Metasploitable, and a Windows XP machine, but are they're any premade lab solutions available that offer up a bit more complexity or even predesignated ...
- 339
2
votes
1
answer
9k
views
How do vlans improve security? [closed]
From my understanding vlans create separate networks. If that is the case can you simply add routes manually and access those other networks?
Basically, I've always been under the impression that ...
- 3,126
2
votes
3
answers
8k
views
How do I restrict network access to LAN for visitors
How do I restrict network access to LAN for visitors?
In my organization's premises any outside visitor can come and connect to the LAN ports in our meeting rooms. We have seen that they are able to ...
- 29
0
votes
2
answers
1k
views
Questions on IDS, IPS, VLANs and VPN [closed]
I have a network that has a single point of entry the WAN. The WAN exposes about 10 static IP's that resolve internally to servers that are in the same subnet. Meaning that if you RDP over 3389 to ...
- 11
0
votes
1
answer
3k
views
Hide a machine on LAN [closed]
Is there any way to hide a computer on LAN? For example maybe with a firewall, when someone is going to ping a machine, it won't answer. In other words the machine must answer to router only.
I am ...
- 439
4
votes
2
answers
11k
views
In a LAN environment, can you fake the IP address while also being able to receive the response?
Looks like nmap could fake source IP address, and getting a valid response, but only in LAN environment. I'm not sure how it works, here's my thought,
You created a packet with fake IP address and a ...
- 2,097
4
votes
1
answer
3k
views
Isolate a Virtualbox VM from local network [closed]
I have the need to isolate a virtual machine created with Virtualbox from the local network but I need to provide internet access to that machine.
It is the first time that I face this kind of problem,...
- 183
5
votes
2
answers
1k
views
Segmenting Virtual Network Traffic
I have a basic to moderate understanding of VLAN's and their pros and cons as they relate to network segmentation but I'm wondering where to start as one moves into virtualized environments.
From a ...
- 286
3
votes
1
answer
1k
views
How to do layer 3 VLAN hopping?
I am connected to 3 layer switch used to create IP subnet-based VLANs. Is there any way to do VLAN hopping? Note that this isn't using 802.1q; it's not port-based L2.
- 437
1
vote
3
answers
4k
views
How to setup an internal firewall
I'm hoping to get some advice on a project I've been asked to look after at work. I do all of the IT for a small company that sits inside of a larger corporation. We need to prevent access to ...
- 303
19
votes
4
answers
4k
views
Threat assesment for a captive portal
I am interested in setting up a captive portal on a wireless network.
From what I understand I would do this by initially having all guests in a temporary vlan, moving them to the real vlan when ...
- 3,606
93
votes
10
answers
144k
views
Why do people tell me not to use VLANs for security?
I have a network, where a have a couple of VLANS. There is a firewall between the 2 VLANs. I am using HP Procurve switches and have made sure that switch-to-switch links accept tagged frames only and ...
- 1,031
10
votes
1
answer
5k
views
Management Network Best Practices
I am looking at setting up a Management vlan, on which I will put all the Management interfaces for my various networkable devices (Firewall Mgmt Interfaces, Server RAC, WAP Mgmt Interfaces, etc).
...
- 1,387