## 5 Real Security Implementations for VPNs and VLANs
### Security Issues and Countermeasures in VLANs  
In this section, we focus on the security of VLAN and how to apply it in a corporate environment. As a reference, we use Cisco switches, but many concepts can be applied for other vendors. The first level of security, and often the most overlooked, is the physical security of the equipment: tampering is always unwanted, so it is good to protect the access to the virtual terminal (VTX), by configuring proper credentials and a timeout:  
\begin{tabular}{l} \hline S\# configure terminal \\ S(config)\# username admin privilege 15 secret P4$Sw0 rd\_! \\ S(config)\# line console 0 \\ S(config-line)\# login local \\ S(config-line)\# password P4$Sw0 rd\_! \\ S(config-line)\# exec-timeout 60 0 \\ \hline \end{tabular}  
In addition, by applying the same configuration also the VTX (telnet/ssh) and creating an access list to limit access only to certain hosts or subnets it is possible avoid brute-force attacks:  
\begin{tabular}{l} \hline S(config)\# line vty 0 15 \\ S(config-line)\# password P4$Sw0 rd\_! \\ S(config-line)\# login local \\ S(config-line)\# exec-timeout 60 0 \\ S(config-line)\# transport preferred ssh \\ S(config-line)\# access-class 115 in \\ S(config)\# access-list 115 remark Inbound Limitations \\ S(config)\# access-list 115 permit ip host 1.2.3.4 any \\ S(config)\# access-list 115 permit ip 192.168.100.0 0.0.255 any \\ \hline \end{tabular}  
The general rule, in addition, is to avoid the use of VLAN 1 (the default VLAN) data traffic, and VLAN pruning. The default VLAN is present in all network devices, as well as being untagged, because it is used for the exchange of information through protocols,  
Figure 6: The typical structure of a VLAN segmented network and the presence of DHCP Relay Agents (RAs) [40].  
such as Cisco Discovery Protocol (CDP) and VTP. Another good technique that a network administrator must consider is the pruning, allowing only strictly necessary VLANs on each link, so considering a switch S:  
S(config)# interface fastethernet0/24  
S(config-if)# switchport trunk allowed valn remove 1,2,3,4,5  
S(config-if)# switchport access valn 24  
It is also suggested to disable 'risky' protocols from all ports if they are not needed. Certain information-exchange protocols, such as CDP and UniDirectional Link Detection (UDLD) for example, can create security holes:  
S(config)# interface fastethernet0/24  
S(config-if)# no cdp enable  
S(config-if)# no udld port  
Pay particular attention to the configuration of VTP--if it appears to be misconfigured, it can become a dangerous security hole. If we consider a Core switch (C) and an Edge Switch (E), the following lines should be considered:  
C(config)# vtp domain VTPdomain  
C(config)# vtp password P4$w0 rd_! secret  
C(config)# vtp mode server  
C(config)# vtp version 2  
C(config)# vtp pruning  
E(config)# vtp domain VTPdomain  
E(config)# vtp password P4$w0 rd_! secret  
E(config)# vtp mode client  
E(config)# vtp version 2  
E(config)# vtp pruning  
Another key feature for VLAN security is the restriction of inter-VLAN routing via access lists. Routing between VLAN should be allowed, but to ensure a higher level of security, the routing can be limited adequately [48]. For example, with the following scripts, VLAN24 can be allowed to access the Internet and only the DNS server of the VLAN:  
C(config)# access-list 100 remark Allow DNS  
C(config)# access-list 100 permit udp 192.168.240.0 0.0.0.255 host 192.168.240.1 eq 53  
C(config)# access-list 100 deny ip 192.168.240.0 0.0.0.255 192.168.240.0 0.0.0.255 log  
C(config)# access-list 100 permit ip 192.168.240.0 0.0.0.255 any  
C(config)# interface valn 24  
C(config-if)# ip access-group 100 in  
Some examples of real VPN implementations can be found in [49, 50, 51].