How to prevent VLAN Hopping in Cisco Switches

1 Comment

  1. Non-negotiate prevents negotiation of a trunk (Duh!) – The surprise gotcha is that’s because it accepts tagged frames by default – It’s most often seen on uplinks to VMware hosts where fast recovery is needed/ desired.

    It’s also sometimes seen on access switches being used with VoIP phones that struggle to successfully negotiate their Voice VLAN…

    Switchport mode access appears to be more “Assertive”, but as mentioned above, it also accepts framed packets if there’s a voice VLAN configured. See “CDP Attacks” for info on how that can make life miserable.

    In either case – Pro tip, it’s always a good idea to manually limit the VLANs permitted on a given Truck – And if you haven’t recently go and check your switches for mistakes or the results of someone getting around you without you noticing.*


Leave a Reply

Your email address will not be published. Required fields are marked *