VLAN hopping is a low-frequency but preventable network attack, and the right switch configurations make mitigation straightforward. This content walks through the specific port and trunk settings that block the attack vectors attackers rely on.
VLAN Hopping Mitigation
VLAN hopping is probably not a very common attack on your networks. The fact is, it takes a little more technical know-how to attack your network, and the benefits of doing it aren't quite as great as some of the other ways to leverage your network. However, the mitigation against it is really easy, so you might as well make these changes on your network. In fact, what we've already done is made these changes on our network just by setting up these switches the way we did, so let's cover what those changes were.
So what configurations have we already made that help us mitigate against VLAN hopping? Let's take a look. I'm on switch 2 right now. Let's take a look at an access interface first. What I'm going to do is a show run, and we'll take a look at one of the access interfaces. Fa0/1 is one of those access interfaces, so we'll get into that.
We can see that first of all it's shut down. So that alone - an attacker can't utilize a shutdown port - that's just security in general, that's nice. And then this is part of a VLAN that doesn't go anywhere, so VLAN 5 can't be trunked to anywhere else on this network, and it's got no DHCP server on there, so it's just a dead end network. So that is also just helpful for security in general.
I don't like to use the default VLAN, and the default VLAN on the Cisco switch is VLAN one, so it is on a separate VLAN that doesn't go anywhere, and so that helps with security.
Now specifically for VLAN hopping, this is an access port and cannot be changed to a trunk port, and that is done by this command right here. So an attacker can't establish Dynamic Trunking Protocol, because this is an access port and it won't allow it to create a trunk line with whoever is on the other side. So an attacker can't utilize this. We've got several steps here that mitigate against VLAN hopping, and several steps that mitigate against several other types of attacks as well.
Next, let's take a look at one of our port channels. Remember, the port channels are going to be our trunk lines between the switches. So I'm going to do a show run, and we'll just take a look at port channel one.
Another thing is that, as I mentioned, the native VLAN is not the default VLAN. By default on our Cisco switches the native VLAN is going to be also the default VLAN, VLAN one. Now I've got this set up as native VLAN 2, so if something does need to connect to this trunk line, it's going to connect on a native VLAN of two. But if you didn't need a native VLAN, you could just turn this off altogether and then you would mitigate against that.
It also is allowing only certain VLANs to go across here. And then it also is set up so it is not using Dynamic Trunking Protocol - it's set up specifically as a trunk line, switchport mode trunk. So now no device that connects to this can establish that Dynamic Trunking Protocol.
Now one thing that I did on one of my switches - switch two, switch one here - let's take a look at it, because it's set up a little differently. I'll do a show run and we'll do interface port channel, and let's take a look at port channel 2.
In this case right here, switchport mode dynamic desirable. So this switchport is set up with DTP, and I don't really like that, so I want to change this to be a trunk line. I'm going to get into there and I'm going to do a switchport mode trunk to turn off DTP. Oh, I do need to get into the interface first, so I'm going to get into the interface: interface port channel 2, and then let's do a switchport mode trunk, and that will turn off DTP.
And I get this rejection right here: the command was rejected, an interface whose trunk encapsulation is auto cannot be configured to trunk mode. So this is a problem. I want to set this for trunk mode and turn off DTP, but it's not allowing me to do this.
There's a simple way to find solutions, and that is to go to Google and look up what it is that you're trying to fix. So in this case I'm just going to type in "whose trunk port is auto". There it is, so it pops up in there.
The reason why this is different, the reason why this is not coming up, is because this is a different type of switch. This is a 3750 and it's got a different firmware version on it. So I looked this up, and what we need to do to fix this is going to be a switchport trunk encapsulation dot1q. So I need to change that first before I can enter in that other command.
Let's try that out: trunk encapsulation dot1q, hit enter. And now I want to do my switchport mode trunk. Now let's take a look at that interface. I'll do an end, do an up arrow, and there we go, now it's set to trunk, and now we don't have DTP turned on on this trunk line.
I would need to do this for my other two port channels as well, because each one of my trunk lines across here needs to be changed to the same type of setting.
TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.
Explore free tools and programs →