FN-GM Posted March 22, 2018 Posted March 22, 2018 Client sends vlan 5 tagged packet to access port Port is native vlan 1 and receives the packet What happens next?As it originated from the native VLAN it will placed it into VLAN 5 and the tag will be removed. It will be then treated as normal trafic.
ITGuyWestMidlands Posted March 22, 2018 Posted March 22, 2018 Its all kind of related... 5 APs ordered though VeryPC Good choice. The APs won't accept traffic from a port tagged on vlan 1 when adopting them, it has to be native. So if running several ssids with different vlan IDs. 1 will need to be native and the others will need to be tagged. What I'm trying to work out is what are the security implications if doing this is all your other switch ports are access ports and dtp is disabled. As it originated from the native VLAN it will placed it into VLAN 5 and the tag will be removed. It will be then treated as normal trafic. If that is the case, what's the purpose of having a trunk at all?
FN-GM Posted March 22, 2018 Posted March 22, 2018 (edited) If that is the case, what's the purpose of having a trunk at all? Well broadly it is working as designed but the design could be exploited. It can be easily mitigated. and dtp is disabled. DTP is another technology and isn't related to the native VLAN issue. Edited March 22, 2018 by FN-GM
newpersn Posted March 22, 2018 Author Posted March 22, 2018 Good choice. The APs won't accept traffic from a port tagged on vlan 1 when adopting them, it has to be native. So if running several ssids with different vlan IDs. 1 will need to be native and the others will need to be tagged. What I'm trying to work out is what are the security implications if doing this is all your other switch ports are access ports and dtp is disabled. If that is the case, what's the purpose of having a trunk at all? APS are going be sat on (untagged 2) and SSIDs (5,6,8 will be tagged)
ITGuyWestMidlands Posted March 22, 2018 Posted March 22, 2018 Well broadly it is working as designed but the design could be exploited. It can be easily mitigated. DTP is another technology and isn't related to the native VLAN issue. https://supportforums.cisco.com/t5/lan-switching-and-routing/vlan-does-the-access-port-drop-the-frame-when-it-received-a/td-p/2295359 But this says otherwise?
ITGuyWestMidlands Posted March 22, 2018 Posted March 22, 2018 APS are going be sat on (untagged 2) and SSIDs (5,6,8 will be tagged) This may be problematic if your controller is on vlan 1 or if you use unifi switches at some point. But should be ok otherwise.
FN-GM Posted March 22, 2018 Posted March 22, 2018 https://supportforums.cisco.com/t5/lan-switching-and-routing/vlan-does-the-access-port-drop-the-frame-when-it-received-a/td-p/2295359 But this says otherwise? It isn't quite the same thing. 1. Native VLAN isn't coming into play. 2. One side is a trunk and the other port is an access port.
ITGuyWestMidlands Posted March 22, 2018 Posted March 22, 2018 It isn't quite the same thing. 1. Native VLAN isn't coming into play. 2. One side is a trunk and the other port is an access port. A frame sent along a native port has no 802.11q header. The vlan IDs on native ports get assigned internally to the switch and tagged on ports only when needed (egress). Have you got packet tracer to try it on. I can send you a lab scenario that will show how tagged packets sent to a access port get dropped.
FN-GM Posted March 23, 2018 Posted March 23, 2018 I don't have it no. They don't make a mac version - besides it is no good for my CCNP renewal. I have the real kit setup at the moment. I will give it a try.
ITGuyWestMidlands Posted March 23, 2018 Posted March 23, 2018 Excellent. It's very limited but useful for mocking up scenarios and sharing them. Some catalysts on certain iOS versions will forward the frame from an access port if it is tagged with with the native vlan of the port; so that may be worth testing also, but still wont allow hopping (unless double tagged).
FN-GM Posted March 31, 2018 Posted March 31, 2018 (edited) I have been reading about this for my CCNP renewal in the book "how to master CCNP Switch" by Rene Molenaar. It isn't a very in-depth book but I use it to break me in and the particle examples are good. Anyway... apparently you can stop VLAN hopping by applying this command to a Cisco switch. It will make it so the native VLAN is tagged on trunk ports thus making it not possible to VLAN hop. Switch(config)# vlan dot1q tag native This is something I didn't know. It wasn't in the first edition of this book and I haven't come across it before. EDIT: I have just been playing with this command in my lab. I had 2 Cisco Catalyst 3560 connected via a 802.1Q trunk. They could ping each other ok. I then placed the command on 1 switch. They could no longer ping each other. I then placed the command on the second switch. They could ping each other again. So you need to set this on both sides. I am not sure how this would play with third party equipment such as the access points. Edited March 31, 2018 by FN-GM
ITGuyWestMidlands Posted March 31, 2018 Posted March 31, 2018 (edited) Great thanks. But what about access ports on vlan 1? A frame with a native vlan on a trunk is the same as an untagged frame on an access port. The command you posted only applies to trunks and therefore only impacts double tagging. If dtp is disabled, I still cant see where the issue is with using vlan 1? Edited March 31, 2018 by ITGuyWestMidlands
newpersn Posted April 5, 2018 Author Posted April 5, 2018 Do you have all you switch’s (main switches in each cabinet all on the same vlan?
Davit2005 Posted April 6, 2018 Posted April 6, 2018 Also interested in the "getting everyone on one SSID with RADIUS vlans" thing - I can see how to do it for domain computers and users on their own device but we've got two ipad SSIDs currently (ipads and ipads-staff) - there must be an easier way to dish out the vlan to ipads via radius besides a huge list of MAC addresses. Is it possible to embed a user/pass in the wifi connection settings pushed via the MDM, then I could just look for that ipad/ipadstaff user? (And also, does anybody have vlans assigned by radius using HP MSM765zl controller? I can see how to do it on the Unifi in the junior school, but the HP for the rest of the site is a nightmare) Sorry for the delay in response. Yes I use Windows 2012 r2 for this, users join the WiFi network and are prompted to enter username and password. Depending on Windows security group the users vlan then gets changed to the appropriate vlan. I simply followed a YouTube guide to set it up, was quite simple to do. On a Windows 2012r2 (prefrabbly one hosting no other roles) Install a Certificate Authority or get a third party cert which would be better, install NPS and add the Access Points (this may need to be the controllers depending). You may equally be able to do this on a Linux based FreeRadius but this will require a bit more config. You can also load balance between NPS servers (using a proxy I think but I'm not sure this will be necessary in majority of cases) or just setup an additional server in case one is down. 1
Katy Posted April 6, 2018 Posted April 6, 2018 Sorry for the delay in response. Yes I use Windows 2012 r2 for this, users join the WiFi network and are prompted to enter username and password. Depending on Windows security group the users vlan then gets changed to the appropriate vlan. I simply followed a YouTube guide to set it up, was quite simple to do. On a Windows 2012r2 (prefrabbly one hosting no other roles) Install a Certificate Authority or get a third party cert which would be better, install NPS and add the Access Points (this may need to be the controllers depending). You may equally be able to do this on a Linux based FreeRadius but this will require a bit more config. You can also load balance between NPS servers (using a proxy I think but I'm not sure this will be necessary in majority of cases) or just setup an additional server in case one is down. Thanks. I ended up working it out myself as I already had NPS configured for the "domain laptops" SSID. Got it working on the HP - after a lot of googling I found a tick box needed to be not ticked for it to use the VLAN assigned by RADIUS - and it wasn't obvious or clear that it had anything to do with VLANs at all. (Not attempted it on the unifi yet as it's a long walk in the cold to the building that has unifi) Shame you can't select a VLAN by user in NPS, had to create a security group for "staff ipads" and "student ipads", each with a single user in which will then be saved into the ipad settings via MDM.
Davit2005 Posted April 6, 2018 Posted April 6, 2018 Thanks. I ended up working it out myself as I already had NPS configured for the "domain laptops" SSID. Got it working on the HP - after a lot of googling I found a tick box needed to be not ticked for it to use the VLAN assigned by RADIUS - and it wasn't obvious or clear that it had anything to do with VLANs at all. (Not attempted it on the unifi yet as it's a long walk in the cold to the building that has unifi) Shame you can't select a VLAN by user in NPS, had to create a security group for "staff ipads" and "student ipads", each with a single user in which will then be saved into the ipad settings via MDM. You can use security groups based on users as well, this is how I did it in my lab at home.
Davit2005 Posted April 6, 2018 Posted April 6, 2018 (edited) Great thanks. But what about access ports on vlan 1? A frame with a native vlan on a trunk is the same as an untagged frame on an access port. The command you posted only applies to trunks and therefore only impacts double tagging. If dtp is disabled, I still cant see where the issue is with using vlan 1? It is not jus for dtp. We never use vlan 1 and it is actually removed from all up links on switches, using HP switches here. Below link is a short info why it should not be used. https://networkengineering.stackexchange.com/questions/32737/why-should-the-native-vlan-never-be-used Edited April 6, 2018 by Davit2005
ITGuyWestMidlands Posted April 6, 2018 Posted April 6, 2018 (edited) I get the management aspect which is fine. But if I use vlan 1 natively across trunks, ensure all access ports are on a different vlan, disable dtp on all switches, I just can't see a scenario where this would be a problem. If a user connects a device it will be on a different vlan and won't be able to negotiate a trunk and any tagged packets sent will get dropped. Edited April 6, 2018 by ITGuyWestMidlands
Davit2005 Posted April 6, 2018 Posted April 6, 2018 (edited) I get the management aspect which is fine. But if I use vlan 1 natively across trunks, ensure all access ports are on a different vlan, disable dtp on all swicthes, I just can't see a scenario where this would be a problem. If a user connects a device it will be on a different vlan and won't be able to negotiate a trunk and any tagged packets sent will get dropped. I'm personally of the thought of implementing multiple security measures to protect any network. I think we are straying off the thread a bit here though Edited April 6, 2018 by Davit2005
ITGuyWestMidlands Posted April 6, 2018 Posted April 6, 2018 (edited) Not really. It's based on the limitations of unifi aps having to have an untagged management vlan and a comment about never using vlan 1. I'm just trying to figure out if having it setup this way is an issue. Edited April 6, 2018 by ITGuyWestMidlands
Katy Posted April 6, 2018 Posted April 6, 2018 How do you actually get unifi APs to listen to the VLAN provided by RADIUS? I managed to get it to work with the HP access points but the same settings won't work on the Unifi. NPS log shows it's giving out the correct information, the WLAN on unifi is set to use a radius server with dynamic VLAN, where there's already a wlan with the same VLAN assigned static I've taken that out, but devices connect and DHCP off the same VLAN that the AP itself sits on.
Katy Posted April 6, 2018 Posted April 6, 2018 How do you actually get unifi APs to listen to the VLAN provided by RADIUS? I managed to get it to work with the HP access points but the same settings won't work on the Unifi. NPS log shows it's giving out the correct information, the WLAN on unifi is set to use a radius server with dynamic VLAN, where there's already a wlan with the same VLAN assigned static I've taken that out, but devices connect and DHCP off the same VLAN that the AP itself sits on. If anyone else can't get it to work try a firmware update, didn't think a 6 month old AP's firmware would be so out of date that something like dynamic VLAN wouldn't work!
Davit2005 Posted April 6, 2018 Posted April 6, 2018 (edited) Not really. It's based on the limitations of unifi aps having to have an untagged management vlan and a comment about never using vlan 1. I'm just trying to figure out if having it setup this way is an issue. I've also seen the HP MSM wireless work much the same way. It could be set up so that the Wireless management is put on a different vlan to switch management vlans, we done this at a previous place. With Ubiquiti switches even the UnifiSwitch models i.e. US-8-150W it is possible to have the management vlan different, although this needs to be untagged on uplinks in the case of the UnifiSwitch models. Edited April 6, 2018 by Davit2005
derf Posted April 7, 2018 Posted April 7, 2018 How do you actually get unifi APs to listen to the VLAN provided by RADIUS? I managed to get it to work with the HP access points but the same settings won't work on the Unifi. NPS log shows it's giving out the correct information, the WLAN on unifi is set to use a radius server with dynamic VLAN, where there's already a wlan with the same VLAN assigned static I've taken that out, but devices connect and DHCP off the same VLAN that the AP itself sits on. With Unifi you can't have a static assigned VLAN and a radius supplied VLAN. If you do then you end up with no traffic, or no IP (can't remember which one). This is over all SSID's I believe.
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now