Configuring Network Segmentation with VLANs
When to Use
- Segmenting an enterprise network into isolated security zones (corporate, servers, DMZ, guest, IoT)
- Meeting compliance requirements (PCI-DSS, HIPAA, SOC 2) that mandate network isolation for sensitive data
- Reducing blast radius of security incidents by preventing lateral movement between network segments
- Isolating high-risk devices (IoT, BYOD, legacy systems) from critical infrastructure
- Implementing defense-in-depth by combining VLANs with firewall rules and access control lists
Do not use VLANs as the sole security control without Layer 3 filtering, for isolating networks that require air-gapping, or without proper switch hardening against VLAN hopping attacks.
Prerequisites
- Managed switches supporting 802.1Q VLAN trunking (Cisco Catalyst, HP Aruba, Juniper EX, etc.)
- Layer 3 switch or firewall for inter-VLAN routing and access control
- Network design document specifying VLAN assignments, IP subnets, and traffic flow requirements
- Console or SSH access to switches with privileged configuration mode
- Understanding of 802.1Q trunking, STP, and inter-VLAN routing concepts
Workflow
Step 1: Design the VLAN Architecture
# Define VLANs based on security zones and function
VLAN Plan:
VLAN 10 - CORPORATE (10.10.10.0/24) - Employee workstations
VLAN 20 - SERVERS (10.10.20.0/24) - Internal servers
VLAN 30 - DMZ (10.10.30.0/24) - Internet-facing servers
VLAN 40 - GUEST (10.10.40.0/24) - Guest WiFi
VLAN 50 - IOT (10.10.50.0/24) - IoT/OT devices
VLAN 60 - VOIP (10.10.60.0/24) - VoIP phones
VLAN 100 - MANAGEMENT (10.10.100.0/24) - Switch/AP management
VLAN 999 - QUARANTINE (10.10.99.0/24) - Isolated/compromised hosts
VLAN 998 - NATIVE_UNUSED - Native VLAN (no traffic)
# Traffic flow matrix:
# CORPORATE -> SERVERS: Allowed (specific ports)
# CORPORATE -> DMZ: Allowed (HTTP/HTTPS only)
# CORPORATE -> GUEST: Denied
# CORPORATE -> IOT: Denied
# GUEST -> Any Internal: Denied
# IOT -> SERVERS: Allowed (specific ports to specific hosts only)
# DMZ -> SERVERS: Allowed (database ports only)
# MANAGEMENT -> All: Allowed (from management stations only)
Step 2: Configure VLANs on Cisco Catalyst Switch
! Enter configuration mode
enable
configure terminal
! Create VLANs
vlan 10
name CORPORATE
exit
vlan 20
name SERVERS
exit
vlan 30
name DMZ
exit
vlan 40
name GUEST
exit
vlan 50
name IOT
exit
vlan 60
name VOIP
exit
vlan 100
name MANAGEMENT
exit
vlan 998
name NATIVE_UNUSED
exit
vlan 999
name QUARANTINE
exit
! Configure access ports for workstations (VLAN 10)
interface range GigabitEthernet1/0/1-24
switchport mode access
switchport access vlan 10
switchport nonegotiate
spanning-tree portfast
spanning-tree bpduguard enable
no shutdown
exit
! Configure access ports for servers (VLAN 20)
interface range GigabitEthernet1/0/25-36
switchport mode access
switchport access vlan 20
switchport nonegotiate
spanning-tree portfast
spanning-tree bpduguard enable
no shutdown
exit
! Configure trunk ports to other switches
interface GigabitEthernet1/0/48
switchport mode trunk
switchport trunk encapsulation dot1q
switchport trunk native vlan 998
switchport trunk allowed vlan 10,20,30,40,50,60,100
switchport nonegotiate
no shutdown
exit
! Configure trunk to firewall/router
interface GigabitEthernet1/0/47
switchport mode trunk
switchport trunk encapsulation dot1q
switchport trunk native vlan 998
switchport trunk allowed vlan 10,20,30,40,50,60,100
switchport nonegotiate
no shutdown
exit
! Shutdown unused ports
interface range GigabitEthernet1/0/37-46
shutdown
switchport mode access
switchport access vlan 999
exit
Step 3: Harden Switch Against VLAN Hopping
! Disable DTP on all ports (prevents switch spoofing)
interface range GigabitEthernet1/0/1-46
switchport nonegotiate
exit
! Set native VLAN to unused VLAN on all trunks
interface range GigabitEthernet1/0/47-48
switchport trunk native vlan 998
exit
! Enable DHCP Snooping
ip dhcp snooping
ip dhcp snooping vlan 10,20,30,40,50,60
interface GigabitEthernet1/0/47
ip dhcp snooping trust
exit
! Enable Dynamic ARP Inspection
ip arp inspection vlan 10,20,30,40,50,60
interface GigabitEthernet1/0/47
ip arp inspection trust
exit
! Enable IP Source Guard (prevents IP spoofing)
interface range GigabitEthernet1/0/1-36
ip verify source
exit
! Enable Port Security
interface range GigabitEthernet1/0/1-24
switchport port-security
switchport port-security maximum 2
switchport port-security violation restrict
switchport port-security aging time 60
exit
! Set VTP to transparent mode (prevents VTP attacks)
vtp mode transparent
! Enable BPDU Guard globally
spanning-tree portfast bpduguard default
! Enable Storm Control
interface range GigabitEthernet1/0/1-36
storm-control broadcast level 10
storm-control multicast level 10
storm-control action shutdown
exit
Step 4: Configure Inter-VLAN Routing with ACLs
! On the Layer 3 switch or firewall, configure SVIs
interface Vlan10
ip address 10.10.10.1 255.255.255.0
no shutdown
exit
interface Vlan20
ip address 10.10.20.1 255.255.255.0
no shutdown
exit
interface Vlan30
ip address 10.10.30.1 255.255.255.0
no shutdown
exit
interface Vlan40
ip address 10.10.40.1 255.255.255.0
no shutdown
exit
interface Vlan50
ip address 10.10.50.1 255.255.255.0
no shutdown
exit
! ACL: Corporate to Servers (allow specific services)
ip access-list extended CORP-TO-SERVERS
permit tcp 10.10.10.0 0.0.0.255 10.10.20.0 0.0.0.255 eq 80
permit tcp 10.10.10.0 0.0.0.255 10.10.20.0 0.0.0.255 eq 443
permit tcp 10.10.10.0 0.0.0.255 10.10.20.0 0.0.0.255 eq 445
permit udp 10.10.10.0 0.0.0.255 10.10.20.0 0.0.0.255 eq 53
permit icmp 10.10.10.0 0.0.0.255 10.10.20.0 0.0.0.255 echo
deny ip any any log
exit
! ACL: Guest to Internet only (deny all internal)
ip access-list extended GUEST-OUTBOUND
deny ip 10.10.40.0 0.0.0.255 10.0.0.0 0.255.255.255
deny ip 10.10.40.0 0.0.0.255 172.16.0.0 0.15.255.255
deny ip 10.10.40.0 0.0.0.255 192.168.0.0 0.0.255.255
permit tcp 10.10.40.0 0.0.0.255 any eq 80
permit tcp 10.10.40.0 0.0.0.255 any eq 443
permit udp 10.10.40.0 0.0.0.255 any eq 53
deny ip any any log
exit
! ACL: IoT limited access
ip access-list extended IOT-OUTBOUND
permit tcp 10.10.50.0 0.0.0.255 host 10.10.20.10 eq 443
permit tcp 10.10.50.0 0.0.0.255 any eq 443
permit udp 10.10.50.0 0.0.0.255 host 10.10.20.1 eq 53
deny ip 10.10.50.0 0.0.0.255 10.10.50.0 0.0.0.255 log
deny ip any any log
exit
! Apply ACLs to VLAN interfaces
interface Vlan10
ip access-group CORP-TO-SERVERS out
exit
interface Vlan40
ip access-group GUEST-OUTBOUND in
exit
interface Vlan50
ip access-group IOT-OUTBOUND in
exit
Step 5: Configure DHCP and DNS per VLAN
! DHCP pools for each VLAN
ip dhcp pool CORPORATE
network 10.10.10.0 255.255.255.0
default-router 10.10.10.1
dns-server 10.10.20.10
domain-name corp.example.com
lease 1
exit
ip dhcp pool GUEST
network 10.10.40.0 255.255.255.0
default-router 10.10.40.1
dns-server 1.1.1.1 8.8.8.8
lease 0 4
exit
ip dhcp pool IOT
network 10.10.50.0 255.255.255.0
default-router 10.10.50.1
dns-server 10.10.20.10
lease 7
exit
! Exclude gateway and server IPs from DHCP pools
ip dhcp excluded-address 10.10.10.1 10.10.10.10
ip dhcp excluded-address 10.10.40.1 10.10.40.10
ip dhcp excluded-address 10.10.50.1 10.10.50.10
Step 6: Verify and Test Segmentation
# From a workstation on VLAN 10 (Corporate):
# Should succeed:
ping 10.10.20.10 # Server access
curl https://10.10.20.10 # HTTPS to server
# Should fail:
ping 10.10.40.100 # Guest VLAN - should be blocked
ping 10.10.50.100 # IoT VLAN - should be blocked
# From a device on VLAN 40 (Guest):
# Should succeed:
ping 8.8.8.8 # Internet access
curl https://www.google.com
# Should fail:
ping 10.10.10.1 # Corporate gateway - blocked
ping 10.10.20.10 # Server - blocked
# Verify switch configuration
show vlan brief
show interfaces trunk
show ip arp inspection statistics
show ip dhcp snooping binding
show port-security
show ip access-lists
# Run VLAN hopping tests (from authorized pentest)
# These should all fail if hardening is correct:
# 1. DTP negotiation - should fail (nonegotiate)
# 2. Double tagging - should fail (native VLAN 998)
# 3. ARP spoofing - should fail (DAI enabled)
Key Concepts
| Term |
Definition |
| VLAN (Virtual LAN) |
Logical network partition at Layer 2 that groups switch ports into isolated broadcast domains, regardless of physical location |
| 802.1Q Trunking |
IEEE standard for VLAN tagging that adds a 4-byte header to Ethernet frames, identifying which VLAN a frame belongs to across trunk links |
| Inter-VLAN Routing |
Layer 3 forwarding of traffic between VLANs using a router, Layer 3 switch, or firewall with access control lists |
| Native VLAN |
VLAN assigned to untagged frames on trunk ports; should be set to an unused VLAN to prevent VLAN hopping attacks |
| DHCP Snooping |
Switch feature that validates DHCP messages and builds a binding table of IP-MAC-port mappings, preventing rogue DHCP servers |
| Port Security |
Switch feature that limits the number of MAC addresses per port and takes action (shutdown, restrict) when violated |
Tools & Systems
- Cisco Catalyst/Nexus: Enterprise managed switches with comprehensive VLAN, trunking, and security feature support
- HP Aruba CX: Enterprise switches with REST API management and VLAN segmentation capabilities
- pfSense/OPNsense: Open-source firewalls for inter-VLAN routing with stateful access control
- NetBox: Open-source IPAM and DCIM tool for documenting VLAN assignments, IP addressing, and network topology
- Nmap: Network scanner for verifying segmentation effectiveness by testing reachability across VLAN boundaries
Common Scenarios
Scenario: Implementing PCI-DSS Compliant Network Segmentation for Retail
Context: A retail chain must isolate their payment card processing systems from the general corporate network to meet PCI-DSS requirements. The current flat network has point-of-sale terminals, employee workstations, inventory servers, and guest WiFi on a single VLAN. The environment uses Cisco Catalyst 9300 switches.
Approach:
- Design VLAN architecture: POS terminals on VLAN 50 (CDE), corporate on VLAN 10, servers on VLAN 20, guest on VLAN 40
- Create VLANs on all access-layer switches and configure access ports by function
- Configure trunk links between switches with explicit VLAN allowed lists (no "all" trunks)
- Set native VLAN to 998 (unused) on all trunks and disable DTP on every port
- Configure ACLs on the Layer 3 switch: CDE VLAN can only reach the payment processor's IP on port 443; no other inter-VLAN traffic to/from CDE
- Enable DHCP snooping, DAI, and port security on all access ports
- Verify segmentation with penetration testing from each VLAN, confirming CDE is fully isolated
Pitfalls:
- Leaving DTP enabled on access ports, allowing VLAN hopping to reach the CDE
- Using VLAN 1 as the native VLAN, enabling double-tagging attacks
- Not restricting trunk allowed VLANs, carrying all VLANs including CDE to non-essential switches
- Creating ACLs that allow "any" source to reach CDE servers instead of specific POS terminal IPs
Output Format
## Network Segmentation Implementation Report
**Network**: Retail Store #42
**Switch Platform**: Cisco Catalyst 9300
**VLANs Configured**: 8
### VLAN Summary
| VLAN ID | Name | Subnet | Ports | Purpose |
|---------|------|--------|-------|---------|
| 10 | CORPORATE | 10.10.10.0/24 | Gi1/0/1-24 | Employee workstations |
| 20 | SERVERS | 10.10.20.0/24 | Gi1/0/25-36 | Internal servers |
| 30 | DMZ | 10.10.30.0/24 | Gi2/0/1-4 | Internet-facing |
| 40 | GUEST | 10.10.40.0/24 | WiFi AP trunk | Guest WiFi |
| 50 | CDE | 10.10.50.0/24 | Gi2/0/5-12 | POS terminals |
| 100 | MGMT | 10.10.100.0/24 | Gi1/0/48 | Switch management |
| 998 | NATIVE | N/A | Trunks only | Unused native |
| 999 | QUARANTINE | 10.10.99.0/24 | Unused ports | Isolation |
### Security Hardening Status
| Control | Status |
|---------|--------|
| DTP Disabled (nonegotiate) | All ports |
| Native VLAN (998) | All trunks |
| DHCP Snooping | VLANs 10,20,40,50 |
| Dynamic ARP Inspection | VLANs 10,20,40,50 |
| Port Security | Access ports |
| BPDU Guard | Access ports |
| Unused Ports Shutdown | 10 ports in VLAN 999 |
| VTP Transparent Mode | Enabled |
1---2name: configuring-network-segmentation-with-vlans3description: Designs and implements VLAN-based (802.1Q) network segmentation on managed switches to isolate zones such as corporate, servers, DMZ, guest, and IoT, and to limit lateral movement paths. Use when segmenting an enterprise network into isolated security zones, meeting compliance mandates (PCI-DSS, HIPAA, SOC 2) for network isolation, or reducing blast radius from a security incident.4license: Apache-2.05---6# Configuring Network Segmentation with VLANs
7
8## When to Use
9
10- Segmenting an enterprise network into isolated security zones (corporate, servers, DMZ, guest, IoT)
11- Meeting compliance requirements (PCI-DSS, HIPAA, SOC 2) that mandate network isolation for sensitive data
12- Reducing blast radius of security incidents by preventing lateral movement between network segments
13- Isolating high-risk devices (IoT, BYOD, legacy systems) from critical infrastructure
14- Implementing defense-in-depth by combining VLANs with firewall rules and access control lists
15
16**Do not use** VLANs as the sole security control without Layer 3 filtering, for isolating networks that require air-gapping, or without proper switch hardening against VLAN hopping attacks.
17
18## Prerequisites
19
20- Managed switches supporting 802.1Q VLAN trunking (Cisco Catalyst, HP Aruba, Juniper EX, etc.)
21- Layer 3 switch or firewall for inter-VLAN routing and access control
22- Network design document specifying VLAN assignments, IP subnets, and traffic flow requirements
23- Console or SSH access to switches with privileged configuration mode
24- Understanding of 802.1Q trunking, STP, and inter-VLAN routing concepts
25
26## Workflow
27
28### Step 1: Design the VLAN Architecture
29
30```
31# Define VLANs based on security zones and function
32
33VLAN Plan:
34 VLAN 10 - CORPORATE (10.10.10.0/24) - Employee workstations
35 VLAN 20 - SERVERS (10.10.20.0/24) - Internal servers
36 VLAN 30 - DMZ (10.10.30.0/24) - Internet-facing servers
37 VLAN 40 - GUEST (10.10.40.0/24) - Guest WiFi
38 VLAN 50 - IOT (10.10.50.0/24) - IoT/OT devices
39 VLAN 60 - VOIP (10.10.60.0/24) - VoIP phones
40 VLAN 100 - MANAGEMENT (10.10.100.0/24) - Switch/AP management
41 VLAN 999 - QUARANTINE (10.10.99.0/24) - Isolated/compromised hosts
42 VLAN 998 - NATIVE_UNUSED - Native VLAN (no traffic)
43
44# Traffic flow matrix:
45# CORPORATE -> SERVERS: Allowed (specific ports)
46# CORPORATE -> DMZ: Allowed (HTTP/HTTPS only)
47# CORPORATE -> GUEST: Denied
48# CORPORATE -> IOT: Denied
49# GUEST -> Any Internal: Denied
50# IOT -> SERVERS: Allowed (specific ports to specific hosts only)
51# DMZ -> SERVERS: Allowed (database ports only)
52# MANAGEMENT -> All: Allowed (from management stations only)
53```
54
55### Step 2: Configure VLANs on Cisco Catalyst Switch
56
57```
58! Enter configuration mode
59enable
60configure terminal
61
62! Create VLANs
63vlan 10
64 name CORPORATE
65 exit
66vlan 20
67 name SERVERS
68 exit
69vlan 30
70 name DMZ
71 exit
72vlan 40
73 name GUEST
74 exit
75vlan 50
76 name IOT
77 exit
78vlan 60
79 name VOIP
80 exit
81vlan 100
82 name MANAGEMENT
83 exit
84vlan 998
85 name NATIVE_UNUSED
86 exit
87vlan 999
88 name QUARANTINE
89 exit
90
91! Configure access ports for workstations (VLAN 10)
92interface range GigabitEthernet1/0/1-24
93 switchport mode access
94 switchport access vlan 10
95 switchport nonegotiate
96 spanning-tree portfast
97 spanning-tree bpduguard enable
98 no shutdown
99 exit
100
101! Configure access ports for servers (VLAN 20)
102interface range GigabitEthernet1/0/25-36
103 switchport mode access
104 switchport access vlan 20
105 switchport nonegotiate
106 spanning-tree portfast
107 spanning-tree bpduguard enable
108 no shutdown
109 exit
110
111! Configure trunk ports to other switches
112interface GigabitEthernet1/0/48
113 switchport mode trunk
114 switchport trunk encapsulation dot1q
115 switchport trunk native vlan 998
116 switchport trunk allowed vlan 10,20,30,40,50,60,100
117 switchport nonegotiate
118 no shutdown
119 exit
120
121! Configure trunk to firewall/router
122interface GigabitEthernet1/0/47
123 switchport mode trunk
124 switchport trunk encapsulation dot1q
125 switchport trunk native vlan 998
126 switchport trunk allowed vlan 10,20,30,40,50,60,100
127 switchport nonegotiate
128 no shutdown
129 exit
130
131! Shutdown unused ports
132interface range GigabitEthernet1/0/37-46
133 shutdown
134 switchport mode access
135 switchport access vlan 999
136 exit
137```
138
139### Step 3: Harden Switch Against VLAN Hopping
140
141```
142! Disable DTP on all ports (prevents switch spoofing)
143interface range GigabitEthernet1/0/1-46
144 switchport nonegotiate
145 exit
146
147! Set native VLAN to unused VLAN on all trunks
148interface range GigabitEthernet1/0/47-48
149 switchport trunk native vlan 998
150 exit
151
152! Enable DHCP Snooping
153ip dhcp snooping
154ip dhcp snooping vlan 10,20,30,40,50,60
155interface GigabitEthernet1/0/47
156 ip dhcp snooping trust
157 exit
158
159! Enable Dynamic ARP Inspection
160ip arp inspection vlan 10,20,30,40,50,60
161interface GigabitEthernet1/0/47
162 ip arp inspection trust
163 exit
164
165! Enable IP Source Guard (prevents IP spoofing)
166interface range GigabitEthernet1/0/1-36
167 ip verify source
168 exit
169
170! Enable Port Security
171interface range GigabitEthernet1/0/1-24
172 switchport port-security
173 switchport port-security maximum 2
174 switchport port-security violation restrict
175 switchport port-security aging time 60
176 exit
177
178! Set VTP to transparent mode (prevents VTP attacks)
179vtp mode transparent
180
181! Enable BPDU Guard globally
182spanning-tree portfast bpduguard default
183
184! Enable Storm Control
185interface range GigabitEthernet1/0/1-36
186 storm-control broadcast level 10
187 storm-control multicast level 10
188 storm-control action shutdown
189 exit
190```
191
192### Step 4: Configure Inter-VLAN Routing with ACLs
193
194```
195! On the Layer 3 switch or firewall, configure SVIs
196interface Vlan10
197 ip address 10.10.10.1 255.255.255.0
198 no shutdown
199 exit
200interface Vlan20
201 ip address 10.10.20.1 255.255.255.0
202 no shutdown
203 exit
204interface Vlan30
205 ip address 10.10.30.1 255.255.255.0
206 no shutdown
207 exit
208interface Vlan40
209 ip address 10.10.40.1 255.255.255.0
210 no shutdown
211 exit
212interface Vlan50
213 ip address 10.10.50.1 255.255.255.0
214 no shutdown
215 exit
216
217! ACL: Corporate to Servers (allow specific services)
218ip access-list extended CORP-TO-SERVERS
219 permit tcp 10.10.10.0 0.0.0.255 10.10.20.0 0.0.0.255 eq 80
220 permit tcp 10.10.10.0 0.0.0.255 10.10.20.0 0.0.0.255 eq 443
221 permit tcp 10.10.10.0 0.0.0.255 10.10.20.0 0.0.0.255 eq 445
222 permit udp 10.10.10.0 0.0.0.255 10.10.20.0 0.0.0.255 eq 53
223 permit icmp 10.10.10.0 0.0.0.255 10.10.20.0 0.0.0.255 echo
224 deny ip any any log
225 exit
226
227! ACL: Guest to Internet only (deny all internal)
228ip access-list extended GUEST-OUTBOUND
229 deny ip 10.10.40.0 0.0.0.255 10.0.0.0 0.255.255.255
230 deny ip 10.10.40.0 0.0.0.255 172.16.0.0 0.15.255.255
231 deny ip 10.10.40.0 0.0.0.255 192.168.0.0 0.0.255.255
232 permit tcp 10.10.40.0 0.0.0.255 any eq 80
233 permit tcp 10.10.40.0 0.0.0.255 any eq 443
234 permit udp 10.10.40.0 0.0.0.255 any eq 53
235 deny ip any any log
236 exit
237
238! ACL: IoT limited access
239ip access-list extended IOT-OUTBOUND
240 permit tcp 10.10.50.0 0.0.0.255 host 10.10.20.10 eq 443
241 permit tcp 10.10.50.0 0.0.0.255 any eq 443
242 permit udp 10.10.50.0 0.0.0.255 host 10.10.20.1 eq 53
243 deny ip 10.10.50.0 0.0.0.255 10.10.50.0 0.0.0.255 log
244 deny ip any any log
245 exit
246
247! Apply ACLs to VLAN interfaces
248interface Vlan10
249 ip access-group CORP-TO-SERVERS out
250 exit
251interface Vlan40
252 ip access-group GUEST-OUTBOUND in
253 exit
254interface Vlan50
255 ip access-group IOT-OUTBOUND in
256 exit
257```
258
259### Step 5: Configure DHCP and DNS per VLAN
260
261```
262! DHCP pools for each VLAN
263ip dhcp pool CORPORATE
264 network 10.10.10.0 255.255.255.0
265 default-router 10.10.10.1
266 dns-server 10.10.20.10
267 domain-name corp.example.com
268 lease 1
269 exit
270
271ip dhcp pool GUEST
272 network 10.10.40.0 255.255.255.0
273 default-router 10.10.40.1
274 dns-server 1.1.1.1 8.8.8.8
275 lease 0 4
276 exit
277
278ip dhcp pool IOT
279 network 10.10.50.0 255.255.255.0
280 default-router 10.10.50.1
281 dns-server 10.10.20.10
282 lease 7
283 exit
284
285! Exclude gateway and server IPs from DHCP pools
286ip dhcp excluded-address 10.10.10.1 10.10.10.10
287ip dhcp excluded-address 10.10.40.1 10.10.40.10
288ip dhcp excluded-address 10.10.50.1 10.10.50.10
289```
290
291### Step 6: Verify and Test Segmentation
292
293```bash
294# From a workstation on VLAN 10 (Corporate):
295# Should succeed:
296ping 10.10.20.10 # Server access
297curl https://10.10.20.10 # HTTPS to server
298
299# Should fail:
300ping 10.10.40.100 # Guest VLAN - should be blocked
301ping 10.10.50.100 # IoT VLAN - should be blocked
302
303# From a device on VLAN 40 (Guest):
304# Should succeed:
305ping 8.8.8.8 # Internet access
306curl https://www.google.com
307
308# Should fail:
309ping 10.10.10.1 # Corporate gateway - blocked
310ping 10.10.20.10 # Server - blocked
311
312# Verify switch configuration
313show vlan brief
314show interfaces trunk
315show ip arp inspection statistics
316show ip dhcp snooping binding
317show port-security
318show ip access-lists
319
320# Run VLAN hopping tests (from authorized pentest)
321# These should all fail if hardening is correct:
322# 1. DTP negotiation - should fail (nonegotiate)
323# 2. Double tagging - should fail (native VLAN 998)
324# 3. ARP spoofing - should fail (DAI enabled)
325```
326
327## Key Concepts
328
329| Term | Definition |
330|------|------------|
331| **VLAN (Virtual LAN)** | Logical network partition at Layer 2 that groups switch ports into isolated broadcast domains, regardless of physical location |
332| **802.1Q Trunking** | IEEE standard for VLAN tagging that adds a 4-byte header to Ethernet frames, identifying which VLAN a frame belongs to across trunk links |
333| **Inter-VLAN Routing** | Layer 3 forwarding of traffic between VLANs using a router, Layer 3 switch, or firewall with access control lists |
334| **Native VLAN** | VLAN assigned to untagged frames on trunk ports; should be set to an unused VLAN to prevent VLAN hopping attacks |
335| **DHCP Snooping** | Switch feature that validates DHCP messages and builds a binding table of IP-MAC-port mappings, preventing rogue DHCP servers |
336| **Port Security** | Switch feature that limits the number of MAC addresses per port and takes action (shutdown, restrict) when violated |
337
338## Tools & Systems
339
340- **Cisco Catalyst/Nexus**: Enterprise managed switches with comprehensive VLAN, trunking, and security feature support
341- **HP Aruba CX**: Enterprise switches with REST API management and VLAN segmentation capabilities
342- **pfSense/OPNsense**: Open-source firewalls for inter-VLAN routing with stateful access control
343- **NetBox**: Open-source IPAM and DCIM tool for documenting VLAN assignments, IP addressing, and network topology
344- **Nmap**: Network scanner for verifying segmentation effectiveness by testing reachability across VLAN boundaries
345
346## Common Scenarios
347
348### Scenario: Implementing PCI-DSS Compliant Network Segmentation for Retail
349
350**Context**: A retail chain must isolate their payment card processing systems from the general corporate network to meet PCI-DSS requirements. The current flat network has point-of-sale terminals, employee workstations, inventory servers, and guest WiFi on a single VLAN. The environment uses Cisco Catalyst 9300 switches.
351
352**Approach**:
3531. Design VLAN architecture: POS terminals on VLAN 50 (CDE), corporate on VLAN 10, servers on VLAN 20, guest on VLAN 40
3542. Create VLANs on all access-layer switches and configure access ports by function
3553. Configure trunk links between switches with explicit VLAN allowed lists (no "all" trunks)
3564. Set native VLAN to 998 (unused) on all trunks and disable DTP on every port
3575. Configure ACLs on the Layer 3 switch: CDE VLAN can only reach the payment processor's IP on port 443; no other inter-VLAN traffic to/from CDE
3586. Enable DHCP snooping, DAI, and port security on all access ports
3597. Verify segmentation with penetration testing from each VLAN, confirming CDE is fully isolated
360
361**Pitfalls**:
362- Leaving DTP enabled on access ports, allowing VLAN hopping to reach the CDE
363- Using VLAN 1 as the native VLAN, enabling double-tagging attacks
364- Not restricting trunk allowed VLANs, carrying all VLANs including CDE to non-essential switches
365- Creating ACLs that allow "any" source to reach CDE servers instead of specific POS terminal IPs
366
367## Output Format
368
369```
370## Network Segmentation Implementation Report
371
372**Network**: Retail Store #42
373**Switch Platform**: Cisco Catalyst 9300
374**VLANs Configured**: 8
375
376### VLAN Summary
377
378| VLAN ID | Name | Subnet | Ports | Purpose |
379|---------|------|--------|-------|---------|
380| 10 | CORPORATE | 10.10.10.0/24 | Gi1/0/1-24 | Employee workstations |
381| 20 | SERVERS | 10.10.20.0/24 | Gi1/0/25-36 | Internal servers |
382| 30 | DMZ | 10.10.30.0/24 | Gi2/0/1-4 | Internet-facing |
383| 40 | GUEST | 10.10.40.0/24 | WiFi AP trunk | Guest WiFi |
384| 50 | CDE | 10.10.50.0/24 | Gi2/0/5-12 | POS terminals |
385| 100 | MGMT | 10.10.100.0/24 | Gi1/0/48 | Switch management |
386| 998 | NATIVE | N/A | Trunks only | Unused native |
387| 999 | QUARANTINE | 10.10.99.0/24 | Unused ports | Isolation |
388
389### Security Hardening Status
390
391| Control | Status |
392|---------|--------|
393| DTP Disabled (nonegotiate) | All ports |
394| Native VLAN (998) | All trunks |
395| DHCP Snooping | VLANs 10,20,40,50 |
396| Dynamic ARP Inspection | VLANs 10,20,40,50 |
397| Port Security | Access ports |
398| BPDU Guard | Access ports |
399| Unused Ports Shutdown | 10 ports in VLAN 999 |
400| VTP Transparent Mode | Enabled |
401```
gabrielmoreira