📖 What is Virtual Local Area Network (VLAN)?
A Virtual Local Area Network (VLAN) is a logical grouping of devices on one or more LANs that are configured to communicate as if they were attached to the same wire. It allows administrators to segment traffic for security without physical cabling changes.
"VLANs are a primary tool for network segmentation. Remember that 'VLAN hopping' is a known attack where an attacker attempts to access other VLANs."
📚 Certification: Certified Information Systems Security Professional (CISSP)
🔑 What are the Key Concepts of Virtual Local Area Network (VLAN)?
- ▸ Broadcast Domain Reduction: VLANs limit the scope of broadcast traffic, improving network performance and reducing congestion by isolating traffic to specific logical groups.
- ▸ IEEE 802.1Q Tagging: This industry standard enables VLAN trunking by adding a tag to Ethernet frames, allowing multiple VLANs to share a single physical link.
- ▸ Inter-VLAN Routing: Because VLANs isolate Layer 2 traffic, a Layer 3 device like a router or multilayer switch is required to facilitate communication between them.
- ▸ Network Segmentation: VLANs enable the implementation of security zones, allowing administrators to apply granular access control lists (ACLs) between different departmental or functional groups.
- ▸ VLAN Hopping Mitigation: Security professionals must disable unused ports and avoid using the default VLAN 1 to prevent attackers from bypassing segmentation via switch spoofing.
🎯 How does Virtual Local Area Network (VLAN) appear on the CISSP Exam?
You may be asked to identify the most efficient way to isolate a guest wireless network from the internal corporate network without deploying additional physical switches.
A scenario might describe an attacker using double-tagging to send packets to a restricted segment; you will be expected to identify this as a VLAN hopping attack.
Expect questions where you must determine the necessary hardware component—such as a Layer 3 switch—to allow controlled communication between two separate, isolated VLANs.
❓ Frequently Asked Questions
What is the difference between a VLAN and a subnet?
A VLAN is a Layer 2 construct that isolates traffic at the data link layer using tags, while a subnet is a Layer 3 logical division of an IP network. They are typically used together to ensure complete isolation.
How does the 'default VLAN' impact security?
Most switches ship with all ports assigned to VLAN 1 by default. Leaving management traffic or user data on this default VLAN increases the risk of VLAN hopping and unauthorized access to switch management interfaces.