cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
2972
Views
5
Helpful
2
Replies

Shutdown ports or put them in VLAN?

glogloglik
Level 1
Level 1

Hello all,

I have always read how it is the best security practice to put unused ports on switch/router into shutdown state. However, at work they put them in unused VLAN which serves just for this purpose.

The only config on that interface:

#switchport mode access

#switchport access vlan 111

By the way, VLAN 111 is active.

I searched a lot on this topic but still do not have the answer. Is it a good security practice? And is it better than shutting down the ports?

Thank you very much for any help :)

1 Accepted Solution

Accepted Solutions

Bobby Stojceski
Level 1
Level 1

Personally I would shut them down. It's no more effort to enable versus change their VLAN when they are in use. In fact, you could argue 'no shut' is easier to type than 'switchport access vlan xx'  :-)

I know in the case of auditors, they say ports should be disabled when not used. Some companies, and more highly restricted networks, specify that ports are not only shut down, but their network ports are completely unpatched from the switch as well.

Back in the day of 'vlan hopping', shutdown was certainly the best method. I'd stick with it.

View solution in original post

2 Replies 2

Bobby Stojceski
Level 1
Level 1

Personally I would shut them down. It's no more effort to enable versus change their VLAN when they are in use. In fact, you could argue 'no shut' is easier to type than 'switchport access vlan xx'  :-)

I know in the case of auditors, they say ports should be disabled when not used. Some companies, and more highly restricted networks, specify that ports are not only shut down, but their network ports are completely unpatched from the switch as well.

Back in the day of 'vlan hopping', shutdown was certainly the best method. I'd stick with it.

Hi,

Shutdown is the best and most secure option.

If VLAN111 is enabled, users can abuse that VLAN to create there own uncontrolled private network.

 

Just my 2 cents.

S.O.

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: