notes: Private VLANS, protected ports

Private VLANs

- Can split a single broadcast domain, defined by a single VLAN, into multiple isolated broadcast subdomains, that are defined by primary VLAN and secondary VLANs.
- Basically it is VLANs inside a VLAN.
- Commonly used in shared layer2 environments, like ISP co-locations/hotel rooms, so two sites/rooms can't communicate directly.
- PVLANs can only be configured when a switch is in VTP transparent mode!!!
- Difference between PVLAN and protected port, PVLAN can span multiple switches whereas protected ports don't.
- Private VLAN information is NOT propagated via VTP.
- Secondary VLANs (isolated and community) do not run their own instance of spanning-tree.

Different port roles:

1. Promiscuous ports - Are allowed to talk to all other ports within the VLAN.
- Are the roles assigned to the primary VLAN ports.

2. Community ports - Are allowed to talk to any other ports only in the same community.

3. Isolated ports - Can only talk to other promiscuous ports.


steps to configure Private VLANS

Note: must be in vtp transparent mode ( so vtp domain must be configured)

1. Create the secondary VLANs as community or isolated.

vlan 1000
private-vlan community

vlan 2000
private-vlan isolated

2. Create the primary VLANs and associate the secondary VLANs.

vlan 100
private-vlan primary
private-vlan association 1000,2000

3. Assign ports to which mode and map/associate it with secondary vlans

interface fa0/1
switchport mode private-vlan promiscuous
switchport private-vlan mapping 100 1000,2000

int fa0/2
switchport mode private-vlan host
switchport private-vlan host-association 100 1000

int fa0/3
switchport mode private-vlan host
switchport private-vlan host-association 100 2000

verification:

show vlan private-vlan


Protected Ports:

are used to prevent traffic from being exchanged at layer 2 between two or more ports that are in the same VLAN.
- Traffic received in a protected port cannot be sent out another protected port, however traffic received in a protected port can be sent out a non-protected port.
This feature is a much smaller subset of the Private VLAN feature, and cannot span between multiple physical switches.


command:

interface FastEthernet0/2
switchport protected

interface FastEthernet0/24
switchport protected

notes: SPAN and RSPAN

- SPAN (Switchport Analyzer)

-Is used to redirect traffic from a port or VLAN onto another for analysis by devices such as a packet sniffer or IPS.
-By default traffic coming in on the destination SPAN port will get dropped.
-The [ingress] keyword tells the switch, which access VLAN inbound traffic on the destination port should belong to.

config-set:

monitor session 1 source vlan 146
monitor session 1 destination interface Fa0/24

monitor session 1 source interface Fa0/4
monitor session 1 destination interface Fa0/24 ingress vlan 146

note: session # are locally significant

RSPAN

- Feature is used when the source port or VLAN that is being monitored, is on a different physical switch than the sniffer.


steps to configure:

1. configure the RSPAN VLAN, which carries special attributes.

SW4:

vlan 500
remote-span

2. configure the source of the traffic for the SPAN session and direct it to the RSPAN VLAN.

SW2:

monitor session 2 source interface Fa0/4
monitor session 2 destination remote vlan 500


3. On the switch with the attached sniffer, create a SPAN session with the source as the RSPAN VLAN and the destination as port where the sniffer is attached.

SW1:

monitor session 2 destination interface Fa0/24 ingress vlan 146
monitor session 2 source remote vlan 500


verification:

show monitor session all

notes: 802.1X Port-Based Authentication

defines a client/server-based access control and authentication protocol that restricts unauthorized clients from connecting to a LAN through publicly accessible ports.

remembers
- DO NOT forget to add “aaa authentication login default none”, else you might lock the switch and forfeit any points related to that switch.
- Uses AAA with RADIUS for authentication
- everytime " aaa new-model" is type it will erase existing aaa config.

You control the port authorization state by using the dot1x port-control interface configuration command and these keywords:

1. force-authorized: Disables 802.1X authentication and causes the port to transition to the authorized state without any authentication exchange required

2. force-unauthorized: Causes the port to remain in the unauthorized state, ignoring all attempts by the client to authenticate

3. auto: Enables 802.1X authentication and causes the port to begin in the unauthorized state

802.1X port-based authentication is supported in two topologies:

1. Point-to-point
2. Wireless LAN

Use the following commands to enable 802.1X authentication. Note that dot1x authentication requires RADIUS as the method.

global:

aaa new-model
aaa authentication dot1x default group radius
dot1x system-auth-control

radius-server host 10.10.10.10
radius-server key cisco
aaa authorization network default group radius

interface:
dot1x port-control auto
dot1x host-mode multihost (multiple devices can be authenticated on that single port)
dot1x auth-fail vlan 888
dot1x auth-fail max 2 (default:3)
dot1x guest-vlan 888
dot1x critical vlan 24 (if port authentication failed, and to ensure port comes up)