We design and build networks to enable systems to communicate
with each other. Just as it is crucial to allow communication
between hosts that require it, it is also important to deny
communications between hosts that have no such requirements. If
hosts are on different network segments, it is easy to set up a
firewall or a router with an access list to block undesired
traffic at the network layer, but when hosts are on the same
segment it is more difficult. In this week's newsletter, I will
be writing about Cisco's implementation of Private Virtual LANs
(PVLAN) to help ensure that network traffic only goes where it
is supposed to.
A VLAN on a network is a broadcast domain. All of the hosts on
that VLAN can communicate with the other members of the same
VLAN. PVLANs allow traffic to be segmented at the data-link
layer (layer 2) of the OSI model, limiting the size of the
broadcast domain.
PVLANs are particularly useful on a DMZ where the server
needs to be available to external connections and possibly
internal connections, but rarely needs to communicate with the
other servers on the DMZ. A PVLAN could be configured to allow
the servers to only communicate with the default gateway on the
DMZ, denying communication between the servers. If one of the
servers was compromised by a hacker, or infected with a virus,
the other servers on the DMZ (the next logical hop for an attack)
would be safe.
A switch port that is part of a PVLAN can be configured in one
of three ways:
1) The port can be configured to be promiscuous. A promiscuous
port will forward traffic from any port on the same PVLAN.
2) The port can be configured in community mode. A community
port can forward traffic to a promiscuous port or a port on the
same community.
3) The port can be configured as isolated. Isolated ports can
only forward traffic to promiscuous ports.
In a PVLAN, promiscuous ports are called the primary VLAN, while
community and isolated ports are called secondary VLANs. A PVLAN
will only have one primary VLAN, but may have several secondary
VLANS.
In the DMZ example mentioned above, the default gateway (either
a router or a firewall) would be connected to a promiscuous port
on the switch, and all of the servers would be connected to
isolated ports (multiple isolated ports can belong to the same
secondary VLAN). This would allow external and internal hosts
to connect to the servers on the DMZ, but the DMZ servers would
be unable to communicate with each other. If there was a web
server on the DMZ that needed to access a database server also
on the DMZ, both servers could be connected to ports configured
for the same community secondary VLAN, effectively isolating the
two servers from the rest of the DMZ while maintaining database
connectivity for the web server.
There are a few issues with PVLANs that should be mentioned.
Switches that use PVLANs must be configured for transparent VTP
mode, so they cannot participate in a VTP domain. If trunking is
used to pass PVLAN information between two switches, all of the
secondary VLAN traffic may be passed over the trunk. Plan your
configuration with care if you are using trunking. Finally, if a
system on an isolated port is compromised, a hacker can send
traffic in such a way that a router will forward the traffic
back to a server on the same subnet, but a different isolated
port (essentially defeating the purpose of the PVLAN). Cisco
strongly recommends using VLAN Access Control Lists (VACL) to
block traffic with a source and destination address on the same
subnet (see the links below for more information on VACLs).
Private VLANs can be a strong addition to your network security
arsenal. The DMZ scenario is only one of many possible uses for
PVLANs (but you will see it in almost every article on PVLANs).
Currently, only the newer models of the Catalyst switches support
PVLAN. This may be a good time to upgrade all of those older
switches that you have on the network--particularly on the DMZ.
FREE subscription to Network World.
Your complimentary subscription will include 50 weekly issues jam packed with news analysis, expert industry opinion and management/career advice, all of which is packaged with your business needs in mind. We want to help you connect the technology dots and help you advance your company's business goals.
Email this Article
Print this Article
