ā05-22-2023 11:40 AM
We are discussing the best way to place PCs onto their desired VLAN. It has been offered that we make all switchports trunks and do VLAN tagging from the PC NICs. How dangerous is this from the perspective that all switchports would be trunks?
Solved! Go to Solution.
ā05-22-2023 12:12 PM
Right.
I dont see, from the security perspect, difference between access and trunk. But, sounds to me a bit weird and you have better solution out there available. For example, if you deploy a radius server you would have feature able to identify the PC and assign the proper vlan dont matter where the device is connected. And with that, you also could benefit from features like dynamic ACL, port-control , MAB, etc.
ā05-22-2023 11:48 AM
@Red Taco thats a lot of effort to configure the PCs NIC to tag a VLAN. The standard way is to explictly configure the switchport connected to the PC as an access port and disable DTP, to ensure the PC does not attempt to negotiate a trunk automatically.
switchport mode access
switchport access vlan X
switchport nonegotiate
If you want to dynamically assign VLANs then you can assign the computer to the VLAN from a RADIUS if using 802.1X.
ā05-22-2023 11:56 AM
That's the method I would typically use, but we have PCs that move around a lot and we're looking for a less manual method - something we could do once and would work no matter where the PC is moved (even another physical site using the same VLANs).
ā05-22-2023 12:12 PM
@Red Taco I would say there would be a huge administrative overhead manually configuring the PCs to trunk VLANs. As I previously mentioned you could use a dynamic solution such as ISE to authenticate, track the user/IP and assign a VLAN. Or depending on the size of your network, perhaps consider SDA fabric.
ā05-22-2023 12:18 PM
You are correct, the cisco high recommend not assign trunk to access port and disable DTP.
let him try hope he will not under attack and loss SW connectivity.
Thanks
MHM
ā05-22-2023 11:49 AM
Hi
First you need to make sure you PCs supports tag, not all does. But, the proper way to put PCs in their vlans is by using the access mode. I dont think it is dangerous to have all ports in trunk mode but it not necessary.
The standard is trunk connects switches and routers and access PCs and servers.
ā05-22-2023 11:50 AM
https://www.ciscopress.com/articles/article.asp?p=1681033&seqNum=3
this security issue and it can lead to VLAN hopping attack
ā05-22-2023 11:51 AM
That's the method I would typically use, but we have PCs that move around a lot and we're looking for a less manual method - something we could do once and would work no matter where the PC is moved (even another physical site using the same VLANs).
ā05-22-2023 11:55 AM - edited ā05-22-2023 12:29 PM
check below
ā05-22-2023 11:57 AM
there is OLD tech called dynamic VLAN membership check it
otherwise you need dot1x
ā05-22-2023 11:56 AM
Then you should consider wifi.
But the question I do is, does thoses PCs supports tag? I dont think this is a very common feature on PCs..
ā05-22-2023 11:58 AM
We're in the process of checking NIC drivers for VLAN tagging features but I wanted to check for security concerns before we get too far down that path.
ā05-22-2023 12:12 PM
Right.
I dont see, from the security perspect, difference between access and trunk. But, sounds to me a bit weird and you have better solution out there available. For example, if you deploy a radius server you would have feature able to identify the PC and assign the proper vlan dont matter where the device is connected. And with that, you also could benefit from features like dynamic ACL, port-control , MAB, etc.
ā05-22-2023 12:13 PM
Thanks, I do think that's the best solution.
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide