Securing with VLANs

November 7, 2016 by Neel Rao

Filed under Network

Last modified November 7, 2016

VLAN Access Lists

Access lists can manage or control traffic as it passes through a switch. When normal access lists are configured on a Catalyst switch, they filter traffic through the use of the Ternary Content Addressable Memory (TCAM). Recall from Chapter 3, “Switch Operation,” that access lists (also known as router access lists or RACLs) are merged or compiled into the TCAM. Each ACL is applied to an interface according to the  direction of traffic—inbound or outbound. Packets can then be filtered in hardware with no switching performance penalty. However, only packets that pass between VLANs can be filtered this way.

Packets that stay in the same VLAN do not ever cross a VLAN or interface boundary and do not necessarily have a direction in relation to an interface. These packets might also be non-IP, non-IPX, or completely bridged; therefore, they never pass through the multilayer switching mechanism.

VLAN access lists (VACLs) are filters that can directly affect how packets are handled within a VLAN.

VACLs are somewhat different from RACLs or traditional access control lists. Although they too are merged into the TCAM, they can permit, deny, or redirect packets as they are matched. VACLs are also configured in a route map fashion, with a series of matching conditions and actions to take.

VACL Configuration

VACLs are configured as a VLAN access map, in much the same format as a route map. A VLAN access map consists of one or more statements, each having a common map name. First, you define the VACL with the following global configuration command:

Switch(config)# vlan access-map map-name [sequence-number]

Access map statements are evaluated in sequence, according to the sequence-number. Each statement can contain one or more matching conditions, followed by an action.

Next, define the matching conditions that identify the traffic to be filtered. Matching is performed by access lists (IP, IPX, or MAC address ACLs), which you must configure independently. Configure a matching condition with the following access map configuration command:

Switch(config-access-map)# match {ip address {acl-number | acl-name}} | {ipx address{acl-number | acl-name}} | {mac address acl-name}

You can repeat this command to define several matching conditions; the first match encountered triggers an action to take. Define the action with the following access map configuration command:

Switch(config-access-map)# action {drop | forward [capture] | redirect interface type mod/num}

A VACL can either drop a matching packet, forward it, or redirect it to another interface. The TCAM performs the entire VACL match and action, as packets are switched or bridged within a VLAN, or routed into or out of a VLAN.

Finally, you must apply the VACL to a VLAN interface using the following global configuration command:

Switch(config)# vlan filter map-name vlan-list vlan-list

Notice that the VACL is applied globally to one or more VLANs listed and not to a VLAN interface (SVI). Recall that VLANs can be present in a switch as explicit interfaces or as inherent Layer 2 entities. The VLAN interface is the point where packets enter or leave a VLAN, so it does not make sense to apply a VACL there. Instead, the VACL needs to function within the VLAN itself, where there is no inbound or outbound direction.

For example, suppose you find a need to filter traffic within VLAN 99 so that host is not allowed to contact any other host on its local subnet. An access list local-17 is created to identify traffic between this host and anything else on its local subnet. Then, a VLAN access map is defined:

If the IP address is permitted by the local-17 access list, the packet is dropped; otherwise, it is forwarded. Example 20-1 shows the commands necessary for this example.

Example 20-1 Filtering Traffic Within the Local Subnet

Switch(config)# ip access-list extended local-17

Switch(config-acl)# permit ip host

Swtich(config-acl)# exit

Switch(config)# vlan access-map block-17 10

Switch(config-access-map)# match ip address local-17

Switch(config-access-map)# action drop

Switch(config-access-map)# vlan access-map block-17 20

Switch(config-access-map)# action forward

Switch(config-access-map)# exit

Switch(config)# vlan filter block-17 vlan-list 99

Private VLANs

Normally, traffic is allowed to move unrestricted within a VLAN. Packets sent from one host to another are normally heard only by the destination host, thanks to the nature of Layer 2 switching.

However, if one host broadcasts a packet, all hosts on the VLAN must listen. You can use a VACL to filter packets between a source and destination in a VLAN if both connect to the local switch.

Sometimes, it would be nice to have the ability to segment traffic within a single VLAN, without having to use multiple VLANs and a router. For example, in a single-VLAN server farm, all servers should be able to communicate with the router or gateway, but the servers should not have to listen to each other’s broadcast traffic. Taking this a step further, suppose each server belongs to a separate organization. Now each server should be isolated from the others but still be able to reach the gateway to find clients not on the local network.

Another application is a service provider network. Here, the provider might want to use a single VLAN to connect to several customer networks. Each customer needs to be able to contact the provider’s gateway on the VLAN. Clearly, the customer sites do not need to interact with each other.

Private VLANs (PVLANs) solve this problem on Catalyst switches. In a nutshell, a normal, or primary, VLAN can be logically associated with special unidirectional, or secondary, VLANs.

Hosts associated with a secondary VLAN can communicate with ports on the primary VLAN (a router, for example), but not with another secondary VLAN. A secondary VLAN is configured as one of the following types:

  • Isolated—Any switch ports associated with an isolated VLAN can reach the primary VLAN but not any other secondary VLAN. In addition, hosts associated with the same isolated VLAN cannot reach each other. They are, in effect, isolated from everything except the primary VLAN.
  • Community—Any switch ports associated with a common community VLAN can communicate with each other and with the primary VLAN but not with any other secondary VLAN. This provides the basis for server farms and workgroups within an organization, while giving isolation between organizations.

All secondary VLANs must be associated with one primary VLAN to set up the unidirectional relationship. Private VLANs are configured using special cases of regular VLANs. However, VLAN Trunking Protocol (VTP) does not pass any information about the private VLAN configuration.

Each of the private VLANs must be configured locally on each switch that interconnects them. You must configure each switch port that uses a private VLAN with a VLAN association. You must also define the port with one of the following modes:

  • Promiscuous—The switch port connects to a router, firewall, or other common gateway device. This port can communicate with anything else connected to the primary or any secondary VLAN. In other words, the port is in promiscuous mode, where the rules of private VLANs are ignored.
  • Host—The switch port connects to a regular host that resides on an isolated or community VLAN. The port communicates only with a promiscuous port or ports on the same community VLAN.

Figure 20-1 shows the basic private VLAN operation. Some host PCs connect to a secondary community VLAN. The two community VLANs associate with a primary VLAN, where the router connects. The router connects to a promiscuous port on the primary VLAN. A single host PC connects to a secondary isolated VLAN, so it can communicate only with the router’s promiscuous port.



Private VLAN Configuration

Defining a private VLAN involves several configuration steps. These steps are described in the sections that follow so you can use them.

Configure the Private VLANs

To configure a private VLAN, begin by defining any secondary VLANs that are needed for isolation using the following configuration commands:

Switch(config)# vlan vlan-id

Switch(config-vlan)# private-vlan {isolated | community}

The secondary VLAN can be an isolated VLAN (no connectivity between isolated ports) or a community VLAN (connectivity between member ports).

Now, define the primary VLAN that will provide the underlying private VLAN connectivity using the following configuration commands:

Switch(config)# vlan vlan-id

Switch(config-vlan)# private-vlan primary

Switch(config-vlan)# private-vlan association {secondary-vlan-list | add secondary-vlanlist | remove secondary-vlan-list}

Be sure to associate the primary VLAN with all of its component secondary VLANs using the association keyword. If the primary VLAN has already been configured, you can add (add) or remove (remove) secondary VLAN associations individually.

These VLAN configuration commands set up only the mechanisms for unidirectional connectivity from the secondary VLANs to the primary VLAN. You must also associate the individual switch ports with their respective private VLANs.

Associate Ports with Private VLANs

First, define the function of the port that will participate on a private VLAN using the following configuration command:

Switch(config-if)# switchport mode private-vlan {host | promiscuous}

If the host connected to this port is a router, firewall, or common gateway for the VLAN, use the promiscuous keyword. This allows the host to reach all other promiscuous, isolated, or community ports associated with the primary VLAN. Otherwise, any isolated or community port must receive the host keyword.

For a nonpromiscuous port (using the switchport mode private-vlan host command), you must associate the switch port with the appropriate primary and secondary VLANs. Remember, only the private VLANs themselves have been configured until now. The switch port must know how to  interact with the various VLANs using the following interface configuration command:

Switch(config-if)# switchport private-vlan host-association primary-vlan-id secondaryvlan-id

For a promiscuous port (using the switchport mode private-vlan promiscuous command), you must map the port to primary and secondary VLANs. Notice that promiscuous mode ports, or ports that can communicate with any other private VLAN device, are mapped, while other secondary VLAN ports are associated. One (promiscuous mode port) exhibits bidirectional behavior, while the other (secondary VLAN ports) exhibits unidirectional or logical behavior.

Use the following interface configuration command to map promiscuous mode ports to primary and secondary VLANs:

Switch(config-if)# switchport private-vlan mapping {primary-vlan-id} {secondaryvlan-list} | {add secondary-vlan-list} | {remove secondary-vlan-list}

As an example, assume the switch in Figure 20-1 is configured as in Example 20-2. Host PCs on ports FastEthernet 1/1 and 1/2 are in community VLAN 10, hosts on ports FastEthernet 1/4 and 1/5 are in community VLAN 20, and the host on port FastEthernet 1/3 is in isolated VLAN 30. The router on port FastEthernet 2/1 is in promiscuous mode on primary VLAN 100. Each VLAN is assigned a role, and the primary VLAN is associated with its secondary VLANs. Then, each interface is associated with a primary and secondary VLAN (if a host is attached) or mapped to the primary and secondary VLANs (if a promiscuous host is attached).

Example 20-2 Configuring Ports with Private VLANs

Switch(config)# vlan 10

Switch(config-vlan)# private-vlan community

Switch(config)# vlan 20

Switch(config-vlan)# private-vlan community

Switch(config)# vlan 30

Switch(config-vlan)# private-vlan isolated

Switch(config)# vlan 100

Switch(config-vlan)# private-vlan primary

Switch(config-vlan)# private-vlan association 10,20,30

Switch(config-vlan)# exit

Switch(config)# interface range fastethernet 1/1 – 1/2

Switch(config-if)# switchport private-vlan host-association 100 10

Switch(config)# interface range fastethernet 1/4 – 1/5

Switch(config-if)# switchport private-vlan host-association 100 20

Switch(config)# interface fastethernet 1/3

Switch(config-if)# switchport private-vlan host-association 100 30

Switch(config)# interface fastethernet 2/1

Switch(config-if)# switchport mode private-vlan promiscuous

Switch(config-if)# switchport private-vlan mapping 100 10,20,30

Associate Secondary VLANs to a Primary VLAN SVI

On switched virtual interfaces (SVIs), or VLAN interfaces configured with Layer 3 addresses, you must configure some additional private VLAN mapping. Consider the SVI for the primary VLAN, VLAN 100, that has an IP address and participates in routing traffic. Secondary VLANs 40 (an isolated VLAN) and 50 (a community VLAN) are associated at Layer 2 with primary VLAN 100 using the configuration in Example 20-3.

Example 20-3 Associating Secondary VLANs to a Primary VLAN

vlan 40

private-vlan isolated

vlan 50

private-vlan community

vlan 200

private-vlan primary

private-vlan association 40,50

interface vlan 200

ip address

Primary VLAN 200 can forward traffic at Layer 3, but the secondary VLAN associations with it are only good at Layer 2. To allow Layer 3 traffic switching coming from the secondary VLANs as well, you must add a private VLAN mapping to the primary VLAN (SVI) interface, using the following interface configuration command:

Switch(config-if)# private-vlan mapping {secondary-vlan-list | add secondary-vlan-list |remove secondary-vlan-list}

The primary VLAN SVI function is extended to the secondary VLANs, instead of requiring SVIs for each of them. If some mapping has already been configured for the primary VLAN SVI, you can add (add) or remove (remove) secondary VLAN mappings individually.

For the example, you would map the private VLAN with the following command:

Switch#interface vlan 200

Switch(config-if)#private-vlan mapping 40,50

Switch Port Monitoring

Suppose a problem exists on your switched network and you want to use a network analyzer to gather data. Of interest is a conversation between two hosts connected to the switch, one on interface FastEthernet 1/1 and the other on FastEthernet 4/7. Both ports are assigned to VLAN 100. If you connect your analyzer to another port on VLAN 100, what will your packet capture show?

Recall that, by definition, switches learn where MAC addresses are located and forward packets directly to those ports. The only time a packet is flooded to ports other than the specific destination is when the destination MAC address has not already been located or when the packet is destined for a broadcast or multicast address. Therefore, your packet capture shows only the broadcast and multicast packets that were flooded to the analyzer’s port. None of the interesting conversation will be overheard.

Catalyst switches can use the Switched Port Analyzer (SPAN) feature to mirror traffic from one source switch port or VLAN to a destination port. This allows a monitoring device, such as a network analyzer, to be attached to the destination port for capturing traffic.

When packets arrive on the source port or VLAN, they are specially marked so that they can be copied to the SPAN destination port as well as the true destination port. In this way, the packet capture receives an exact copy of the packets that are being forwarded from the source.

SPAN is available in several different forms:

  • Local SPAN—Both the SPAN source and destination are located on the local switch. The source is one or more switch ports.
  • VLAN-based SPAN (VSPAN)—A variation of local SPAN where the source is a VLAN rather than a physical port.
  • Remote SPAN (RSPAN)—The SPAN source and destination are located on different switches. Mirrored traffic is copied over a special-purpose VLAN across trunks between switches from the source to the destination.

The sections that follow describe each of these SPAN forms in more detail.

Local SPAN and VSPAN

 The SPAN source can be identified as one or more physical switch ports, a trunk, or a VLAN. Packets that are being forwarded from the destination are also copied into the destination port’s queue. Because the packets are merely copied, neither the original data nor its being forwarded is affected. Figure 20-2 demonstrates two cases where a network analyzer on the SPAN destination port is receiving frames that SPAN has copied from the source port. Here, SPAN session A monitors all communication on VLAN 100. SPAN session B uses a normal access mode source port to monitor communication between a server and its client PCs.



What happens if a speed mismatch occurs between the SPAN source and destination ports? This could easily happen if the source is a VLAN with many hosts, or if the source is a GigabitEthernet port and the destination is a FastEthernet port.

Packets are copied only into the destination port’s egress queue. If the destination port becomes congested, the SPAN packets are dropped from the queue and are not seen at the destination port.

Therefore, if the bandwidth of source traffic exceeds the destination port speed, some packets might not be seen at the destination port. Then, traffic from the SPAN source is not affected by any congestion at the SPAN destination.

You can configure one or more simultaneous SPAN sessions on a Catalyst switch. These sessions are completely independent because no interaction occurs between the packet mirroring of each.

To configure a SPAN session, start by defining the source of the SPAN session data, using the following global configuration command:

Switch(config)# monitor session session source {interface type mod/num | vlan vlan-id} [rx | tx | both]

SPAN sessions must be uniquely numbered using the session parameter. The maximum number of supported sessions varies among Catalyst platforms. For example, a Catalyst 3550 can support two sessions, whereas a Catalyst 6500 can support up to 64. If multiple sources are needed, you can repeat this command. The SPAN source can be a physical switch interface or a Layer 2 VLAN (not a logical VLAN interface or SVI).

Traffic can be selected for mirroring based on the direction it is traveling through the SPAN source.

For example, you can select only traffic received on the source (rx), only traffic transmitted from the source (tx), or traffic in both directions (both). By default, both directions are used.

Next, identify the SPAN destination. You must assign the SPAN source and destination ports to the same VLAN within the switch; otherwise, the switch cannot copy frames from one VLAN to another. Use the following global configuration command to identify the SPAN destination:

Switch(config)# monitor session session destination {{interface type mod/num} | {vlanvlan-id} | {analysis-module slot-number} | {data-port port-number}}

The session number here must match the one configured for the SPAN source. You can define only one destination port for each SPAN session. In addition, SPAN sessions cannot share a destination port. The destination can be a physical interface, a Layer 2 VLAN (not a VLAN SVI interface), or a Network Analysis Module (NAM, Catalyst 6500 only).

You can narrow down the data copied over from the source, if necessary. If the source is a trunk port, you can mirror only traffic from specific VLANs on the trunk with the following global configuration command:

Switch(config)# monitor session session-number filter vlan vlan-range

Also, if using a VACL, you can identify and mark interesting traffic for SPAN capture. In this case, use the capture keyword in the VACL action statement.

You can delete a SPAN session after the packet analysis is complete. SPAN sessions are numbered, so you can delete them by referencing the number. Use the following global configuration command to delete one or more sessions:

Switch(config)# no monitor session {{range session-range} | local | all | session}

Session numbers can be given as an individual session, a range of sessions, all local SPAN sessions, or all sessions (local or remote). To see the list of currently active SPAN sessions, use the show monitor EXEC command, as shown in Example 20-4. Here, two SPAN sessions are in use on a Catalyst 3550.

Example 20-4 Displaying the Currently Active SPAN Sessions

Switch# show monitor

Session 1


Type : Local Session

Source Ports:

RX Only: None

TX Only: None

Both: Fa0/7

Source VLANs:

RX Only: None

TX Only: None

Both: None

Source RSPAN VLAN: None

Destination Ports: Fa0/47

Encapsulation: Native

Ingress: Disabled

Reflector Port: None

Filter VLANs: None


Session 2


Type : Local Session

Source Ports:

RX Only: None

TX Only: None

Both: Gi0/1

Source VLANs:

RX Only: None

TX Only: None

Both: None


Source RSPAN VLAN: None

Destination Ports: Gi0/2

Encapsulation: Native

Ingress: Disabled

Reflector Port: None

Filter VLANs: None


Remote SPAN

In a large switched network or one that is geographically separated, it might not always be convenient to take a network analysis to the switch where a SPAN source is located. To make SPAN more extensible, Cisco developed the Remote SPAN (RSPAN) feature. With RSPAN, the source and destination can be located on different switches in different locations.

The RSPAN source is identified on one switch, just as with local SPAN. The RSPAN destination is identified on its local switch. Then, RSPAN can carry only the mirrored data over a special-purpose VLAN across trunk links and intermediate switches. As long as every switch along the way is RSPAN-capable, the source can be located at the far-end switch, while the network analyzer is conveniently located at the switch nearest you.

Figure 20-3 shows an example network using RSPAN where the packets from the file server (source port) on one switch are copied and transported over the RSPAN VLAN on trunk links. At the destination switch, packets are pulled off the RSPAN VLAN and copied to the network analyzer (destination port). The file server and network analyzer are stationed in geographically separate locations.



The RSPAN VLAN has some important differences from a regular VLAN. First, MAC address learning is disabled on the RSPAN VLAN. This is to prevent intermediate switches that transport the RSPAN VLAN from trying to forward the mirrored packets to their real destination MAC addresses. After all, the purpose of SPAN or RSPAN is to simply mirror or copy interesting frames—not forward them normally.

An RSPAN-capable switch also floods the RSPAN packets out all of its ports belonging to the RSPAN VLAN in an effort to send them toward the RSPAN destination. Intermediate switches have no knowledge of the RSPAN source or destination; rather, they know only of the RSPAN VLAN itself.

Remote SPAN Configuration

 RSPAN configuration begins with the definition of the special-purpose RSPAN VLAN. If you configure the RSPAN VLAN on a VTP server, VTP correctly propagates it to other intermediate switches. If not using VTP, be sure to configure this VLAN for RSPAN explicitly on each intermediate switch. Otherwise, the RSPAN packets will not be delivered correctly.

In addition, if VTP pruning is in use, the RSPAN VLAN will be pruned from unnecessary trunks, limiting the traffic impact in unrelated areas of the network.

Create and maintain one or more RSPAN VLANs for the special monitoring purpose only. Set aside one RSPAN VLAN for each RSPAN session that will be used. Don’t allow any normal hosts to join an RSPAN VLAN. Define an RSPAN VLAN on each switch between the source and destination with the following configuration commands:

Switch(config)# vlan vlan-id

Switch(config-vlan)# remote-span

Next, you must identify the RSPAN source and destination on the two switches where the sourceand destination are connected. At the source switch, identify the source and destination with the following global configuration commands:

Switch(config)# monitor session session source {interface type mod/num | vlan vlan-id}[rx | tx | both]

Switch(config)# monitor session session destination remote vlan rspan-vlan-id

Here, the source is either a physical switch interface or a Layer 2 VLAN (not a VLAN SVI interface). Notice that the command syntax is identical to the Local SPAN source command. The RSPAN destination is simply the RSPAN VLAN. This allows the mirrored packets to be copied into the special VLAN and sent on their way toward the final RSPAN destination.

At the destination switch, you must again identify the RSPAN source and destination by using the following global configuration commands:

Switch(config)# monitor session session source remote vlan rspan-vlan-id

Switch(config)# monitor session session destination {interface type | vlan vlan-id}

Here, the roles are reversed. RSPAN packets are pulled from the RSPAN VLAN and placed onto the destination, which is either a physical switch interface or a Layer 2 VLAN.

In Example 20-5, RSPAN is configured on all three switches shown in Figure 20-3. The source is connected to Catalyst A port FastEthernet 1/1. The destination is a network analyzer connected to port FastEthernet 4/48 on Catalyst C. Catayst B simply passes the RSPAN session traffic overVLAN 999, transported by trunk links.

Example 20-5 Configuring RSPAN on the Catalyst Switches in Figure 20-3

Catalyst A

vlan 999


monitor session 1 source interface fastethernet 1/1 both

monitor session 1 destination remote vlan 999

Catalyst B

vlan 999


Catalyst C

vlan 999


monitor session 1 source remote vlan 999

monitor session 1 destination interface fastethernet 4/48


By N.R.Rao

For SkyBird Technology Solutions Pvt Ltd.


Leave a Comment