VLAN hopping: how one port reaches every VLAN

The technique has two forms. Switch spoofing: the attacker's device negotiates a trunk with the switch, through Cisco's DTP, or Huawei's equivalent, LNP. Catalyst 9000 ports default to dynamic auto, Catalyst 6500 ports to dynamic desirable, and several Huawei lines also negotiate by default.

Double tagging: a frame carries two VLAN tags, the switch removes the outer one on the native VLAN, and forwards the frame into a VLAN the attacker was never in.

A port on the LAN is enough: a meeting room, a printer port, a desk. No account. The switch does the rest, because its defaults allow it.

Normal traffic stays in its lane. The attacker's port sits in the trunk's native VLAN, and its frame carries two tags.

The switch removes the first, sees the second, and sends the frame into the management VLAN. Two tags in, one stripped: the frame lands where it never belonged.

Every VLAN on the trunk is within reach, including management. A guest or user port can reach your servers.

And the segmentation you relied on for an audit no longer holds.

Set every user port to access mode, and on Cisco, stop negotiation with switchport nonegotiate. On Huawei, disable LNP, and set link types explicitly.

Move the native VLAN off VLAN 1, to a VLAN nobody uses, and tag it on trunks where the platform allows, as Cisco and Aruba do. Allow only the VLANs each trunk needs.

Juniper trunks already drop untagged frames by default.

NacTrack checks Cisco switch configurations for ports that can still negotiate a trunk, and for trunks left on native VLAN 1.

Sources: Cisco Catalyst 9000 and 9300 guides, Huawei LNP and VLAN guides, Aruba AOS-CX 10.14, Juniper EX, NSA NISG, ANSSI.

Defensive education: the attack is shown in principle only, with no exploitation steps, tools or payloads. Command outputs and configurations are examples; check your platform and release in the vendor's documentation.