What Is VLAN Hopping?

A VLAN creates a logical Layer 2 network segment. Normally, traffic belonging to one VLAN should remain within that VLAN unless a Layer 3 device intentionally routes traffic between VLANs.

```

VLAN 10                    VLAN 20
Employees                  Servers

PC-A                       Server
|                           |
+------ Switch -------------+

Traffic should remain
inside its intended VLAN
unless routing is configured. 

VLAN hopping attempts to bypass this separation by exploiting weaknesses in trunking or VLAN-tag handling.

Why Is VLAN Hopping Dangerous?

VLANs are often used as part of network segmentation. For example:

If an attacker can bypass intended VLAN boundaries, they may gain access to traffic or systems that should not be directly reachable from their segment.

VLAN hopping does not automatically give an attacker access to every device in every VLAN. The actual impact depends on the switch configuration, topology, tagging behavior, and other security controls.

Two Common VLAN Hopping Techniques

1. Switch Spoofing
2. Double Tagging

These techniques work differently and have different prerequisites.

1. Switch Spoofing

Switch spoofing attempts to make an attacker's device negotiate a trunk relationship with a switch.

Historically, Cisco networks could use DTP (Dynamic Trunking Protocol) to dynamically negotiate trunking between interfaces.

```

Attacker
|
| Sends trunk negotiation
v
+---------+
| Switch  |
|         |
+---------+
||
|| Potential trunk
||
Multiple VLANs 

If a user-facing port is allowed to dynamically become a trunk, an attacker may attempt to exploit this behavior.

How Switch Spoofing Can Be Prevented

A strong practice is to configure user-facing interfaces as access ports rather than allowing dynamic trunk negotiation.

```

Switch(config)# interface gigabitEthernet 0/10
Switch(config-if)# switchport mode access 

DTP negotiation can also be disabled on interfaces where it is not required:

```

Switch(config-if)# switchport nonegotiate 

The exact combination should match the switch platform and interface configuration.

2. Double-Tagging Attack

Double tagging is another VLAN hopping technique. It involves an Ethernet frame carrying two VLAN tags.

```

Original Frame

[ Outer VLAN Tag ][ Inner VLAN Tag ][ Data ]

```
   ↓
```

Switch processes the outer tag

```
   ↓
```

Outer tag removed

```
   ↓
```

Frame continues with inner VLAN tag 

In a specific topology, an attacker may attempt to exploit the handling of the native VLAN on an 802.1Q trunk.

Double-Tagging Example

```

Attacker
VLAN 10
|
|
v
+----------+
| Switch 1 |
+----------+
||
|| 802.1Q Trunk
||
+----------+
| Switch 2 |
+----------+
|
|
Target VLAN 

The attacker constructs a frame with an outer VLAN tag associated with the native VLAN and an inner tag associated with a target VLAN.

When the frame traverses the trunk, the outer tag may be removed according to native VLAN handling, leaving the inner tag for subsequent processing.

This is why native VLAN design and trunk configuration are important parts of Layer 2 security.

What Is the Native VLAN?

On a traditional Cisco 802.1Q trunk, the native VLAN is the VLAN whose traffic is normally sent untagged on that trunk.

```

802.1Q Trunk

VLAN 10  ---- Tagged
VLAN 20  ---- Tagged
VLAN 30  ---- Tagged
Native VLAN ---- Normally Untagged 

Native VLAN configuration therefore deserves careful attention when designing secure trunk links.

VLAN Hopping Prevention Checklist

• Configure user-facing ports explicitly as access ports.
• Do not unnecessarily allow trunk negotiation on access ports.
• Disable DTP negotiation where it is not required.
• Use a dedicated, unused VLAN as the native VLAN where appropriate.
• Do not use the native VLAN for normal user traffic.
• Ensure trunk links are explicitly configured.
• Allow only required VLANs on trunk links.
• Use consistent VLAN configuration across switches.
• Combine VLAN controls with ACLs, firewalls, and other security controls.

Configure a Trunk Explicitly

A trunk between switches can be explicitly configured instead of relying on dynamic negotiation:

```

Switch(config)# interface gigabitEthernet 0/1
Switch(config-if)# switchport mode trunk 

On platforms that support the command, DTP negotiation can be disabled:

```

Switch(config-if)# switchport nonegotiate 

Restrict Allowed VLANs on a Trunk

If a trunk only needs to carry VLANs 10, 20, and 30, there is little reason to allow every VLAN across the trunk.

```

Switch(config)# interface gigabitEthernet 0/1
Switch(config-if)# switchport trunk allowed vlan 10,20,30 

This follows the principle of least privilege: allow only what the link actually needs.

Configure a Dedicated Native VLAN

A dedicated native VLAN that is not used for normal endpoint traffic can reduce exposure to certain native-VLAN-related attack scenarios.

```

Switch(config)# interface gigabitEthernet 0/1
Switch(config-if)# switchport trunk native vlan 999 

The same native VLAN configuration should be intentionally coordinated on both ends of the trunk.

Switch Spoofing vs Double Tagging

Packet Tracer Lab: Secure VLANs and Trunks

```

PC1 ---- Switch1 ===== Switch2 ---- PC2
VLAN 10       VLAN 20

===== = 802.1Q trunk 

Practice the following:

1. Create VLAN 10 and VLAN 20.
2. Assign endpoint ports as access ports.
3. Configure the switch-to-switch connection as a trunk.
4. Configure an appropriate native VLAN.
5. Allow only the required VLANs on the trunk.
6. Disable unnecessary trunk negotiation.
7. Verify the configuration.

```

show vlan brief
show interfaces trunk
show interfaces switchport 

Quick Quiz

1. What is VLAN hopping?

2. What are two commonly discussed VLAN hopping techniques?

3. Why should user-facing ports normally be configured as access ports?

4. What is special about the native VLAN on an 802.1Q trunk?

Key Takeaways

• VLAN hopping attempts to bypass VLAN segmentation.
• Switch spoofing attempts to obtain trunk behavior from an access-facing port.
• Double tagging uses two VLAN tags and can exploit native VLAN/trunk behavior in certain designs.
• User-facing ports should normally be explicitly configured as access ports.
• Disable unnecessary DTP negotiation.
• Use a carefully designed native VLAN.
• Allow only required VLANs across trunks.
• VLAN security should be combined with broader network security controls.