Cisco PIX 525 Dokumentacja Pobierz pdf (Strona 96)

2-36

Cisco PIX Firewall and VPN Configuration Guide

78-15033-01

Chapter 2 Establishing Connectivity

Using VLANs with the Firewall

Note To determine the maximum number of logical interfaces that you can use, subtract the number of

physical interfaces in use on your PIX Firewall from the number of total interfaces.

VLAN Security Issues

By default, with no VLANs configured, the PIX Firewall sends untagged packets to any directly

connected switch. If an untagged packet is received by a switch on a trunk port, the switch forwards the

packet on the native VLAN assigned for that trunk port. By default, switches assign VLAN 1 to the

native VLAN.

In the attack called “jumping VLANs” an attacker injects packets onto other VLANs from the native

VLAN. To prevent this attack, never allow access to a native VLAN from any untrusted network. For

maximum security, we recommend avoiding the use of native VLANs altogether when deploying

VLANs in a secure environment. It is permitted to use native VLANs with the PIX

Firewall, but you

should clearly understand the security implications.

To prevent the forwarding of traffic from the PIX Firewall onto the native VLAN of a switch, use the

interface physical command to assign a VLAN ID (other than VLAN 1) to the physical interface of the

PIX

Firewall. Be careful to assign a VLAN ID that is different from whatever VLAN ID is assigned to

the native VLAN on the switch.

Configuring PIX Firewall with VLANs

PIX Firewall Version 6.3 introduces the capability to interconnect VLANs, as illustrated in Figure 2-9.

Figure 2-9 Using PIX Firewall (Version 6.3) to Interconnect VLANs

Internet

83962

Cisco PIX Firewall

Access

layer switch

Distribution

layer switch

Trunking

VLAN2VLAN1

In Figure 2-9, two VLANs are configured on two switches. Workstations are connected to the access

layer switch, while servers are connected to the distribution layer switch. Links using the 802.1q

protocol interconnect the two switches and the PIX

Firewall. The 802.1q protocol allows trunking

VLAN traffic between devices, which means that traffic to and from multiple VLANs can be transmitted

over a single physical link. Each packet contains a VLAN tag that identifies the source and destination

VLAN.

The PIX Firewall supports 802.1q, allowing it to send and receive traffic for multiple VLANs on a single

interface.

1 2 ... 91 92 93 94 95 96 97 98 99 100 101 ... 465 466

Komentarze do niniejszej Instrukcji

Brak uwag

Cisco PIX 525 Dokumentacja Strona 96

Komentarze do niniejszej Instrukcji

Powiązane produkty i podręczniki dla Systemy kontroli dostępu bezpieczeństwa Cisco PIX 525