How can I set up VLANs in a way that won't put me at risk for VLAN hopping?

Posted by hobodave on Server Fault See other posts from Server Fault or by hobodave
Published on 2011-02-22T20:43:07Z Indexed on 2011/02/22 23:26 UTC
Read the original article Hit count: 292

Filed under:

security

|

virtualization

|

vlan

We're planning to migrate our production network from a VLAN-less configuration to a tagged VLAN (802.1q) configuration. This diagram summarizes the planned configuration:

VLAN configuration

One significant detail is that a large portion of these hosts will actually be VMs on a single bare-metal machine. In fact, the only physical machines will be DB01, DB02, the firewalls and the switches. All other machines will be virtualized on a single host.

One concern that has been is that this approach is complicated (overcomplicated implied), and that the VLANs are only providing an illusion of security, because "VLAN hopping is easy".

Is this a valid concern, given that multiple VLANs will be used for a single physical switch port due to virtualization? How would I setup my VLANs appropriately to prevent this risk?

Also, I've heard that VMWare ESX has something called "virtual switches". Is this unique to the VMWare hypervisor? If not, is it available with KVM (my planned hypervisor of choice)?. How does that come into play?

© Server Fault or respective owner

Related posts about security

sudo apt-get update errors

as seen on Ask Ubuntu - Search for 'Ask Ubuntu'
Here is what I get on my terminal when running sudo apt-get update errors. I dont know if the issue is from my sources.list or my proxy setup(have not made any changes to proxies). Thank you for any help in advanced. Ign http://security.ubuntu.com oneiric-security Release.gpg Ign http://security… >>> More
The Security-Developer Gap: Why IT Security Can't Fix Your Security Problems Alone

as seen on Devx - Search for 'Devx'
Two well-known white hats explain how hackers take advantage of security holes left by enterprise application developers. >>> More
The Security-Developer Gap: Why IT Security Can't Fix Your Security Problems Alone

as seen on Internet.com - Search for 'Internet.com'
Two well-known white hats explain how hackers take advantage of security holes left by enterprise application developers. >>> More
StackOverFlowError while creating Mac object on AS400/Java

as seen on Stack Overflow - Search for 'Stack Overflow'
Hello all, I am a newbie to AS400-Java programming. I am trying to create my first program to test the implementation of Message Authentication Code (MAC). I am trying to use the HMACSHA1 hash function. My (Java 1.4) program runs fine on a dev box (V5R4).But fails terribly on the QA box (V5R3). My… >>> More
Google App Engine - Spring Security Issue (java.security.AccessControlException)

as seen on Stack Overflow - Search for 'Stack Overflow'
I'm currently getting the AccessControlException below when I deploy to app engine (I don't see it when I run in my local environment). I'm using GAE 1.3.1, Spring 3.0.1, and Spring Security 3.0.2. Any ideas how to get around this issue? It appears to be an issue with Spring Security trying to get… >>> More

Related posts about virtualization

Storage Virtualization, Redux: Arise File Virtualization

as seen on Internet.com - Search for 'Internet.com'
As virtual storage finds its way into enterprises, file-level and block-level virtualization are most talked-about approaches. Block-level virtualization has already captured the hearts of many firms. Now, file-level virtualization is gearing up for a second coming. >>> More
Free Oracle Special Edition eBook - Server Virtualization for Dummies

as seen on Oracle Blogs - Search for 'Oracle Blogs'
Oracle has released a quick and easy-to-read guide on Oracle Virtualization. Now available is "Server Virtualization for Dummies," an Oracle Special Edition eBook. Need to virtualize, but not sure where to start? Virtualization should make things simpler, not more complex. … >>> More
Reducing Virtualization's Storage Demands

as seen on Internet.com - Search for 'Internet.com'
They're early in development, but some new technologies hold promise for reducing server virtualization's demand on storage environments. >>> More
Storage Virtualization Gets Serious

as seen on Internet.com - Search for 'Internet.com'
Virtually Speaking: A torrent of products are being unleashed to meet the challenges of backing up virtual machines. From cloud storage to golden image management, virtualization technologies for storage are on the move. >>> More
Helping Storage Keep Up With Server Virtualization

as seen on Internet.com - Search for 'Internet.com'
If you virtualize your server environment without taking storage into consideration, your performance will likely suffer. >>> More