Switching · VLANs and Trunking

VLAN hopping

Harden host and trunk boundaries against unintended VLAN admission.

Independent lab examples; selected output and frame summaries are illustrative. Port naming and command support vary by switch and software release.

Network and objective

This is a defensive design lesson. No exploit generation or unauthorized traffic is required.

Use two fresh lab switches: H1 on SW1 Gi1/0/1, H2 on SW2 Gi1/0/1, and Gi1/0/24 between the switches. No other production links are connected. SW1’s endpoint ports should never negotiate an uplink, and its native VLAN should not be an ordinary user segment.

Physical links are solid; device roles and relevant links are labeled.

How it works

A dynamically negotiable endpoint port can admit unintended trunk behavior. Configure static access at the edge and explicit trunks only toward trusted inter-switch peers. Limit trunk VLAN membership to the domains actually needed.

In certain legacy/native-tag designs, stacked tags can cross an unintended boundary when an outer native tag is removed. Keep native domains away from user access, match native policy and use native tagging where supported and designed. VLAN segmentation alone does not authenticate a host or replace higher-layer controls.

Configure or inspect

vlan 10
vlan 20
vlan 99
interface GigabitEthernet1/0/1
 switchport mode access
 switchport access vlan 10
 switchport nonegotiate
interface GigabitEthernet1/0/24
 switchport mode trunk
 switchport nonegotiate
 switchport trunk native vlan 99
 switchport trunk allowed vlan 10,20

Verify the result

Illustrative output · selected lines

SW1#show interfaces GigabitEthernet1/0/1 switchport
Administrative Mode: static access
Operational Mode: static access
Negotiation of Trunking: Off
SW1#show interfaces trunk
Gi1/0/24  on 802.1q trunking 99

The endpoint port is not a dynamic trunk candidate. Verify VLAN99 exists and both ends match; confirm the restricted allowed list and absence of user access assignments in the native domain.

Failure and recovery

A forgotten dynamic desirable edge port or user port in the native domain violates the intended boundary. Audit effective port roles, not only templates stored in a document.

Restore static edge roles and the intended unused native domain, then validate legitimate traffic and configuration compliance without running an exploit.

Key Takeaways

Use explicit host-facing access roles.
Suppress supported negotiation deliberately.
Allow only needed VLANs on trunks.
Keep user access away from unused native domains.
Segmentation and authentication are complementary controls.