14.9.11 Packet Tracer - Layer 2 | Vlan Security

interface g0/1 switchport mode trunk switchport nonegotiate If a port is for a user, it should be an access port, period. Don't let devices negotiate their way into privilege. Step 3: Changing the Native VLAN (Double Tagging Defense) The Threat: In a double-tagging attack, the attacker sends a frame with two 802.1Q tags. The first tag (native VLAN) is stripped off by the first switch. The second tag (say, VLAN 10) is then visible to the next switch, potentially letting the attacker hop into a restricted VLAN.

Never use VLAN 1 for anything. Not for native VLAN, not for management, not for users. VLAN 1 is the universal key to many Layer 2 attacks. Step 4: DHCP Snooping – Stopping the Rogue Server The Threat: An attacker plugs in a laptop running a rogue DHCP server. When legitimate clients broadcast for an IP, the rogue server replies first, giving them a malicious gateway (the attacker) or a bogus DNS server (phishing).

interface g0/1 switchport trunk native vlan 999 Then, ensure VLAN 999 exists but is used nowhere else. No user devices, no DHCP, no routing.

interface range fa0/1-24 switchport mode access switchport nonegotiate On the actual trunk between switches: 14.9.11 packet tracer - layer 2 vlan security

Port Security.

The four techniques in form the backbone of the Cisco Cyber Threat Defense model:

Layer 2 security is invisible when done right. But when it's missing, the whole network crumbles. What other Layer 2 attacks worry you most—CDP/LLDP recon, STP manipulation, or ARP poisoning? Drop a comment below. The first tag (native VLAN) is stripped off

On any port that should not be a trunk (i.e., all end-user ports), explicitly turn off trunking:

On the access ports connecting to end devices (Fa0/1, Fa0/2, etc.), you need to lock down the MAC addresses.

In the world of networking, we often talk about firewalls, ACLs, and encryption. But what happens if an attacker simply unplugs a legitimate user’s laptop and plugs in a rogue device? What if they spoof a VLAN or launch a MAC flood? Not for native VLAN, not for management, not for users

That’s where comes in. It’s the often-overlooked foundation of network defense.

Happy (secure) switching.

Let’s break down what this lab teaches and why it matters in the real world. Imagine you are responsible for a corporate network. Users are in VLAN 10 (Employees) and VLAN 20 (Guests). The lab presents a simple topology: one multilayer switch (distribution), one layer 2 switch (access), and a few PCs.

By default, switches are trusting. And trust, in security, is a vulnerability.

Instead of using VLAN 1 (the default native VLAN), change it to, for example, VLAN 999.