* Dr. Internet columnist Steve Blass discusses how to use private virtual LANs to bolster security
I’ve seen private virtual LANs (PVLAN) described as a way to isolate DMZ servers from each other by restricting traffic between switch ports. Cisco’s PVLAN allows ports to be promiscuous, isolated or a member of a community, where promiscuous ports can
I’ve seen private virtual LANs described as a way to isolate DMZ servers from each other by restricting traffic between switch ports. Cisco’s PVLAN let ports be promiscuous, isolated or members of a community.
Promiscuous ports talk to any ports, isolated ports talk only to promiscuous ports, and community members talk to promiscuous ports or other community members. If in our LAN environment we placed printers and servers on promiscuous ports and workstations on isolated ports, could we reduce the risk of compromised PCs spreading worms and malware?
Limiting LAN workstations to server-only connections through PVLAN switch configuration settings could reduce risks. Trunking protocol settings and device routing rules can override PVLAN switch restrictions, so you will need to provide virtual LAN (http://www.networkworld.com/details/471.html) access control lists that block intra-workstation traffic along with the PVLAN port assignments.
Restrict the range of media access control addresses allowed to connect to each switch port. For even more security, collect unused ports in a VLAN with no Layer 3 access permissions. PVLAN implementations that can operate in IEEE 802.1q VLAN environments are available from Cisco and others.
