How to secure Protocol-VLAN: what to do with PVID?

A

Apachez

Weaksauce
Joined
Aug 20, 2012
Messages
118
Failed to get response at HP's forum so Ill try Hardforum instead :)

A common use for Protocol-VLAN is when you want IPv4/ARP to go into one VLAN and IPv6 into another.

Such as:

#
vlan 100
description R1
protocol-vlan 0 mode ethernetii etype 0806
protocol-vlan 4 ipv4
#
vlan 101
description 01_CUSTOMER
protocol-vlan 6 ipv6
#
...
#
vlan 148
description 48_CUSTOMER
protocol-vlan 6 ipv6
#

#
interface GigabitEthernet1/0/1
description 01_CUSTOMER
port link-type hybrid
undo port hybrid vlan 1
port hybrid vlan 100 101 untagged
port hybrid protocol-vlan vlan 100 0
port hybrid protocol-vlan vlan 100 4
port hybrid protocol-vlan vlan 101 6
port-isolate enable
#

However the above means that PVID is still set to VLAN 1 according to "display interface GigabitEthernet 1/0/1":

PVID: 1
Mdi type: auto
Port link-type: hybrid
Tagged VLAN ID : none
Untagged VLAN ID : 100-101

As I understand the use of Protocol-VLAN goes something like (according to http://www.startnetworks.info/2011/07/vlan-technology-2.html , Im having a hard time locating a reference from HP/H3C on how this actually works):

"
* If the packet matches the protocol template, and the In port of the packet is allocated to the VLAN of the corresponding VLAN ID, the packet is allocated to VLAN ID corresponding to the port configuration protocol template.

* If the packets have no matched protocol template, the packets are divided to the default VLAN ID of the port.
"

My interpretation of this (if this is correct) is that sure IPv4/ARP goes into VLAN 100 and IPv6 goes into VLAN 101. But if some other ethertype shows up that goes into VLAN 1... which sounds bad because this would mean that for example two IPX clients connected to two physical interfaces of this switch would be able to bypass the security model.

So how to secure a Protocol-VLAN configuration as above so that if the ethertype doesnt match IPv4/ARP/IPv6 then the packet arriving from the client should be dropped?
 
To each port his own, otherwise unused PVID?

Edit: That's something I do with tagged-only ports - set their PVIDs to 4094, 4093 etc. to make _really_ sure they won't talk to each other.
 
Last edited:
Sounds like a good workaround, the drawback is obviously waste of vlan id's (specially with a box with many interfaces).

Or for that matter that the "template" (like vlan 4001 for int1 ... vlan 4099 for int99) might break if you need a vlan id from this range for other purpose.
 
Sure, I only use it because in my case, interoperability on the VLAN level is not required and all IDs are managed in a closed system.

It also baffles me that such an advanced feature like protocol VLANs has no provisions to deal with situations like this. I mean normally my case doesn't even require setting the PVID since I have these ports set to "tagged only" anway. It's just a paranoid precaution to protect against misconfiguration or software error.

Is there no setting like "ONLY forward protocols I specify and drop everything else"? That's the first thing I'd implement if I were to design something like protocol VLANs.
 
If such config exists then I have failed to locate its syntax after reading those manuals back and forth :)
 
Looks like assigning a PVID to unconfigured vlan is possible which seems to be the best option in this case.

That is adding this to gi 1/0/1 on SW1:

port hybrid pvid vlan 3101

and so on.

The PVID will match the ACL number and hey presto, easy to audit :)
 
You must log in or register to reply here.
Back
Top