Mitigating VLAN Attacks緩解 VLAN 攻擊

The VLAN architecture simplifies network maintenance and improves performance. However, VLAN operation opens the door to abuse.

VLAN 架構簡化了網路維護並改善了效能。然而，VLAN 的運作方式也帶來了被濫用的風險。

VLAN hopping allows traffic from one VLAN to be seen by another VLAN without first crossing a router. Under certain circumstances, attackers can sniff data and extract passwords and other sensitive information at will.

VLAN 跳躍（VLAN hopping）允許一個 VLAN 的流量在未先經過路由器的情況下被另一個 VLAN 看見。在某些情況下，攻擊者可以任意側錄資料並擷取密碼與其他敏感資訊。

The attack works by taking advantage of an incorrectly configured trunk port. By default, trunk ports have access to all VLANs and pass traffic for multiple VLANs across the same physical link, generally between switches.

此攻擊是利用組態錯誤的中繼埠（trunk port）進行的。預設情況下，中繼埠可以存取所有 VLAN，並在同一實體連結上（通常是在交換器之間）傳遞多個 VLAN 的流量。

In a basic VLAN hopping attack, the attacker takes advantage of the fact that DTP is enabled by default on most switches. The network attacker configures a system to use DTP to negotiate a trunk link to the switch. As a result, the attacker is a member of all the VLANs that are trunked on the switch and can "hop" between VLANs. In other words, the attacker can send and receive traffic on all those VLANs.

在基本的 VLAN 跳躍攻擊中，攻擊者利用大多數交換器預設啟用 DTP 這一點。網路攻擊者會設定一個系統，使用 DTP 與交換器協商成為中繼連結。如此一來，攻擊者就成為該交換器上所有中繼 VLAN 的成員，並可在這些 VLAN 之間「跳躍」。換句話說，攻擊者可以在所有這些 VLAN 上收發流量。

The best way to prevent a basic VLAN hopping attack is to turn off DTP on all ports, and explicitly configure trunking mode or access mode as appropriate on each port.

防範基本 VLAN 跳躍攻擊的最佳方法，是在所有連接埠上關閉 DTP，並在每個連接埠上明確設定為中繼模式或存取模式。

The double-tagging (or double-encapsulated) VLAN hopping attack takes advantage of the way that hardware operates on some switches. Some switches perform only one level of 802.1Q decapsulation and allow an attacker, in specific situations, to embed a second 802.1Q tag inside the frame. This tag allows the frame to go to a VLAN that the outer 802.1Q tag did not specify. An important characteristic of the double-encapsulated VLAN hopping attack is that it can work even if DTP is disabled on the attacker’s access port.

雙重標記（或稱雙重封裝）VLAN 跳躍攻擊，利用的是某些交換器硬體的運作方式。有些交換器只會執行一層 802.1Q 解封裝，這使得攻擊者在特定情況下，可以在框架內嵌入第二個 802.1Q 標記。這個標記能讓框架前往外層 802.1Q 標記未指定的 VLAN。雙重封裝 VLAN 跳躍攻擊的一項重要特性，是即使攻擊者的存取埠已停用 DTP，這種攻擊仍然可以成功。

It is important to note that this attack is unidirectional and works only when the attacker’s VLAN and trunk port native VLAN are the same. Stopping this type of attack is not as easy as stopping basic VLAN hopping attacks. The best approach is to create a VLAN to use as the native VLAN on all trunk ports and explicitly do not use that VLAN for any access ports.

值得注意的是，這種攻擊是單向的，且只有在攻擊者所在 VLAN 與中繼埠的原生 VLAN 相同時才會成功。要阻止此類攻擊並不像阻止基本 VLAN 跳躍攻擊那樣容易。最佳做法是建立一個專用 VLAN，作為所有中繼埠的原生 VLAN，並明確不將該 VLAN 用於任何存取埠。

To prevent a VLAN hopping attack that uses double 802.1Q encapsulation, the switch must look further into the packet to determine whether more than one VLAN tag is attached to a given frame. Unfortunately, the application-specific integrated circuits (ASICs) that many switches use are only hardware optimized to look for one tag and then switch the frame.

為了防範利用雙重 802.1Q 封裝的 VLAN 跳躍攻擊，交換器必須進一步檢視封包內容，以判斷某個框架上是否附加了超過一個 VLAN 標記。不幸的是，許多交換器所使用的特殊應用積體電路（ASIC）在硬體層面上只針對尋找一個標記然後交換該框架做了最佳化。

The double-tagging VLAN hop attack requires that the attacker is on the native VLAN of the outbound trunk port. This attack can be mitigated by ensuring that no systems attach to the native VLAN used by trunks. Specify a unique native VLAN for use on all trunk ports and do not use that VLAN anywhere else on the switch.

雙重標記 VLAN 跳躍攻擊要求攻擊者必須位於出向中繼埠的原生 VLAN 上。可以透過確保沒有任何系統連接到中繼埠所使用的原生 VLAN 來緩解此攻擊。請為所有中繼埠指定一個專用的原生 VLAN，並且不要在交換器上的其他任何地方使用該 VLAN。