Re: [Xen-users] Secure VLANs

[Simon Hobson <linux@xxxxxxxxxxxxxxxx>]

Jonathan Tripathy wrote:

> If I were to connect my VLAN-aware fiirewall directly into the Dom0, 
> what security consideration would I have to take into account? Would 
> there even be a "native VLAN" in this case (since there is no 
> switch)?
I don't think the lack of a switch would make any different - you 
still have (on each device) a default VLAN into which any untagged 
packets received will be placed. That's all the 'native VLAN' is.

In many (most, all ?) VLAN capable switches, VLAN 1 is automatically 
created, and all ports default to be members of VLAN1 and untagged. 
Similarly, the management processor is connected to VLAN1 and this 
often cannot be changed.
Hence the advice to avoid allowing VLAN1 on 'insecure' ports since 
that potentially gives customer/whoever access to the management 
processor on the switch.
So just don't give access to VLAN1 on your insecure ports, and set 
the default VLAN on these ports to something other than 1 if you have 
the port set to expect tagged packets.

I'm not too certain how this combines with bridges under Linux though !

--
Simon Hobson

Visit http://www.magpiesnestpublishing.co.uk/ for books by acclaimed
author Gladys Hobson. Novels - poetry - short stories - ideal as
Christmas stocking fillers. Some available as e-books.

_______________________________________________
Xen-users mailing list
Xen-users@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-users