Introduction
In our last lesson, we focused on critiquing a network's IP addressing plan from an efficiency standpoint. You learned how to spot wasted address space, calculate the savings from a VLSM plan, and verify that a design is free from critical flaws like overlapping subnets.
Today, we shift our focus from efficiency to security. A network can be perfectly efficient with its IP allocation but dangerously insecure. As an architect, you must be able to analyze a design and identify the weak points an attacker could exploit. This lesson is about learning to see your network through the eyes of an adversary.
Our learning outcome is to identify security gaps or inefficiencies in a sample architecture's VLAN and ACL implementation. We will explore common vulnerabilities at Layer 2 and Layer 3, moving from basic port security to the complexities of inter-VLAN access control and even security risks within VRF designs.
1. Why Secure Segmentation is Non-Negotiable
Before diving into technical details, it's crucial to understand why we obsess over segmentation. A "flat" network, where every device can communicate with every other device, is a disaster waiting to happen. Proper segmentation limits the "blast radius" of a security breach.
Let's begin by reading a short article that explains the core principles and illustrates them with a powerful real-world example.
Network Segmentation: VLANs, VPNs & Firewalls
This article from DestCert provides a clear explanation of why network segmentation is a fundamental security practice. It discusses lateral movement, incident containment, and provides a stark case study of what happens when segmentation fails.
First, read the sections 'Why Network Segmentation Matters,' 'How Segmentation Reduces Lateral Movement,' and 'How Segmentation Improves Incident Containment.' Then, read the 'Case Study: Colonial Pipeline' sections. Focus on how the lack of internal segmentation allowed an initial breach to become a catastrophic failure.
The Colonial Pipeline attack is a perfect example. The initial breach was through a single VPN account. The real failure was the lack of internal segmentation, which allowed the attackers to move laterally from the IT network to critical operational systems, forcing a shutdown. Our job as designers is to build the internal walls (VLANs, ACLs, VRFs) that prevent such a scenario.
2. Spotting Gaps at Layer 2: The Open Door
Security starts at the physical layer. An unused but active network port in a conference room or public area is a physical invitation for an attacker. Layer 2 security is about controlling who can get on the network in the first place.
The following video demonstrates how easily an attacker can exploit an open port and discusses two fundamental L2 security practices to prevent it.
you NEED to learn Port Security…….RIGHT NOW!! // FREE CCNA // EP 14
This video from NetworkChuck starts by showing a real-world attack tool, the 'Shark Jack,' which exploits open Ethernet ports. It then demonstrates two crucial security measures: shutting down unused ports and using a 'black hole VLAN' for ports that must remain active but unassigned.
Watch the video from the beginning to 07:22. Pay close attention to: How the attack tool works and what it needs to succeed (an active port on a network with DHCP). The concept and configuration of administratively shutting down unused ports. The use of a 'black hole VLAN' to isolate active but unassigned ports, preventing them from accessing any production resources.
Key Security Gaps at Layer 2:
- Unused Active Ports: Any port not in use should be
shutdownin the switch configuration. An active port is an unnecessary risk. - Default VLAN Assignment: Ports that are up but unassigned often default to VLAN 1. If VLAN 1 is used for anything (even if it shouldn't be), this provides an instant entry point. The "black hole VLAN" strategy solves this by isolating these ports in a VLAN that has no SVI and goes nowhere.
- Lack of Port Security: While not covered in detail in the video clip, advanced features like
switchport port-securitycan lock a port to a specific MAC address (or a limited number of them), preventing an attacker from unplugging a legitimate device and plugging in their own.
When you analyze a switch configuration, look for interfaces that are not in a shutdown state and are not explicitly assigned to a function. These represent potential security gaps.
3. Analyzing Gaps at Layer 3: Flawed ACLs
Once an attacker is on the network, their ability to move laterally depends on the rules governing inter-VLAN traffic. These rules are enforced by Access Control Lists (ACLs), typically applied to the Switched Virtual Interfaces (SVIs) on your Layer 3 switch. A poorly written ACL can render your VLAN segmentation almost useless.
Common ACL implementation errors include:
- Overly Permissive Rules: A rule like
permit ip any anyat the end of an ACL means you are operating in a "default allow" mode. Every single threat has to be explicitly denied. A more secure posture is "default deny," where you only permit traffic that is explicitly required. - Incorrect Order: ACLs are processed top-down. A broad
permitrule placed before a specificdenyrule will cause the deny rule to never be hit. - Asymmetric Rules: Forgetting that traffic is bidirectional. You might block a user from initiating a connection to a server, but if the server can initiate a connection to the user, you may still have a vulnerability.
Example: A Correct ACL Implementation
Let's watch a video that shows how to properly implement ACLs to enforce a security policy between VLANs. Understanding the correct way is the first step to spotting the incorrect way.
Network#20: Control Inter-VLAN routing by ACLs
This video provides a practical, step-by-step demonstration of configuring extended ACLs on a multi-layer switch to control inter-VLAN routing.
Watch from 02:34 to 10:22. Focus on how the ACL is constructed and applied: Notice the use of an extended ACL to specify both source and destination. See how a broad deny statement (VLAN 200 to VLAN 50) is followed by a permit ip any any to allow other traffic. Observe how a more specific permit rule is added with a lower sequence number (sequence 5) to create a specific exception to the broad deny rule.
Practice Analysis: Spot the Gap
Now, let's use what you've learned to critique a sample design. Examine the topology and the associated ACLs below.
ACL 101 Rules:
deny ip host 192.168.1.10 host 192.168.3.10deny tcp any any eq 22permit ip host 192.168.2.10 anypermit ip any any
Your Task: Analyze these rules. Can you identify any potential security gaps or inefficient policies? Think about the principles of "least privilege" and "default deny."
Click here for the analysis.
Here are some potential gaps in this ACL implementation:
- Rule 4:
permit ip any any: This is the biggest red flag. This rule, placed at the end, means any traffic not explicitly denied by the rules above it is allowed. This creates a "default allow" policy, which is generally considered insecure. A better practice would be to have an implicit (or explicit)deny ip any anyat the end and only permit specific, required traffic flows. - Rule 3:
permit ip host 192.168.2.10 any: This rule is extremely permissive. It states that HOST3 (192.168.2.10) is allowed to send any IP traffic to any destination. This single rule could allow that one host to completely bypass the intended segmentation and access the SQL Server, DHCP server, and any other device on any VLAN. This violates the principle of least privilege. - Rule 2:
deny tcp any any eq 22: This rule blocks SSH from anywhere to anywhere. While this might seem secure, it's also inefficient and lacks granularity. What if an administrator on a dedicated management VLAN needs to SSH into the switches or servers? This rule would block them. A better approach would be to deny SSH from most VLANs but explicitly permit it from a trusted management network.
In summary, this ACL creates a false sense of security. While it has some specific deny statements, the overly permissive permit rules effectively undermine the entire segmentation strategy.
4. Advanced Gaps: Security Risks in VRF Designs
You've expressed a specific need to manage internet access using Virtual Routing and Forwarding (VRF). VRFs are excellent for creating isolated virtual routers within a single physical device, which is perfect for separating corporate traffic from guest or internet-only traffic. However, this isolation can be broken if not configured carefully.
A common design is to have multiple VRFs (e.g., VRF-CORP, VRF-GUEST) that use a third VRF-INTERNET to access a shared internet connection. The security gap arises when traffic can leak from one VRF to another by "pivoting" through the shared VRF.
[PDF] VRF-lite Feature Overview and Configuration Guide
This Allied Telesis guide on VRF-Lite is highly technical, but it contains crucial explanations of how inter-VRF security can be compromised. We will focus on the concepts, not the deep configuration details.
This is a dense document, so focus on these specific points: First, read the section 'Inter-VRF communication' (page 9) to understand the concept of 'route leaking' for shared services like internet access. Next, read 'How VRF-Lite security is maintained' (page 24). This short section explains that routes copied from one VRF cannot be re-copied to another, which is a built-in security feature. Finally, and most importantly, review the 'Configure the hardware ACLs' section, specifically the note on page 58. This note explains a critical vulnerability: how an external router in a shared VRF can be used to route traffic between two supposedly isolated VRFs, and how hardware ACLs are required to prevent this. This is a perfect example of a subtle but significant security gap.
The key takeaway is that VRF isolation is not absolute, especially when shared services are involved. An external device (like your internet router) might route traffic back into your switch in a way that bypasses the intended VRF separation. This is why multi-layered security is vital. Even with VRFs, you still need ACLs applied at the right interfaces to act as a backstop and enforce your security policy, preventing this kind of unintended traffic flow.
Conclusion
In this lesson, you learned to move beyond efficiency and critique a network design for security vulnerabilities. We've seen that security is a multi-layered effort, requiring attention to detail from the physical port all the way to complex routing virtualisation.
Key Takeaways:
- Secure segmentation is about limiting lateral movement and containing the blast radius of a breach.
- Layer 2 security gaps often involve unsecured physical ports. Best practices include shutting down unused ports and using "black hole" VLANs.
- Layer 3 security gaps frequently stem from poorly designed ACLs. Overly permissive rules (
permit any) and incorrect ordering can nullify your VLAN strategy. A "default deny" posture is more secure. - VRF designs provide strong isolation but can have vulnerabilities. Shared services can become pivot points, and you must use ACLs to prevent unintended route leaking between isolated VRFs.
Preview of the Next Lesson:
We have now critiqued a design for both efficiency and security. The final aspect of our analysis is scalability. In the next lesson, we will assess the scalability and summarization potential of a given IP addressing plan. You will see how a hierarchical, well-segmented design not only improves security but also makes the network easier to manage and scale through effective route summarization.