Security officers and network administrators today are sitting between a rock and a hard place. At the same time that cybersecurity threats seem to be multiplying by the day, networks are scaling up and becoming increasingly complex to accommodate the growing needs of business IT. Being able to enforce some segregation between networked assets as well as the outside world is a key factor in maintaining security and reducing your overall risk of exposure.
However, PVLANs and alternative strategies exist to try and manage multi-layered and complex network topologies. To get you on your way, that’s exactly what we’ll discuss in this article.
Taking proactive action to secure your networks against an expanding threat landscape is a must in order to limit your chance of falling victim to cybercriminals.
LIFARS is an industry leader that develops proactive strategies and tactics against evolving cybersecurity threats. Our services such as comprehensive gap assessment, red-teaming, penetration testing, threat hunting, and vulnerability assessment reveal a company’s vulnerabilities. Our vCISOs will ensure your optimal cybersecurity strategy and adequate posture.
What is a PVLAN?
A VLAN (Virtual LAN or Virtual local area network) is a broadcast domain that partitions a computer network at the data link layer. The goal is to separate network applications from each other while sharing the same network equipment, such as cables and switches. On top of certain logistical benefits, it allows for also isolation applications to improve overall network security.
Also called port isolation, a PVLAN (or, Private VLAN) is a technique that restricts switch ports in the VLAN to only communicate with a specific uplink. This uplink can be a centralized resource, such as a server, router, firewall, or provider network. The switch port routes all traffic to the uplink, regardless of their VLAN ID or MAC address while communication from the uplink to the network is handled normally.
An everyday example of a private VLAN is an Ethernet-to-the-home or Ethernet-in-the-first-mile network for a home or hotel where multiple rooms may have separate internet access ports that eventually connect through a single ISP.
A PVLAN divides a primary VLAN into sub-VLANs while maintaining the same IP subnet and layer 3 configurations. In short, it takes the single broadcast domain that is a VLAN into separate broadcast domains on the same physical network.
A PVLAN uses two types of main VLANs (or ports):
1. Promiscuous (P-Ports): These ports can communicate inbound and outbound traffic with all other ports on the VLAN.
2. Host ports:
- Isolated (I-Ports): Only communicates with P-Ports.
- Community (C-Ports): Only communicates with ports in the same community VLAN or P-Ports.
Why are PVLANs important?
The first and foremost is reason to implement PVLAN is to enforce network segregation, both internally and externally. Internally, customers who should be able to communicate with each other can be placed within the same community VLANs. Those who should be isolated from each other can be placed on separate community VLANs or on isolated VLANs where they can or with the primary VLAN.
The logical layering of the network into primary and secondary VLANs allows for this type of isolation while also allowing top-down network-wide communication via a single point-of-contact or uplink.
Externally, protects customers by not allowing them to directly communicate with hosts outside the network. All traffic that moves in and out of the primary VLAN will pass through a single router which can enforce traffic filtering or a firewall. This drastically shrinks the overall exposure boundary of the network. It can also help carry out more effective network forensics or network intrusion detection and prevention.
There are often licensing limits as to the number of VLANs supported by a firewall as well as a hard limit of 4095 segregated networks for VLANs. PVLANs have no limits, making it a suitable solution to scale the number of segregated LANs indefinitely with a single firewall.
PVLANs also offer a number of other benefits to network administrators who want to implement a secure network infrastructure:
- You can migrate from a flat network to a segregated network without changing host IP addresses
- You can preserve IP addressing because all secondary VLANs share the same subnet
There is no need to separate the IP subnet for each customer
- The firewall interface does not need to be adjusted as the number of VLANs scale
What Alternatives are there to PVLANs?
The concept of PVLANs was established to overcome many of the challenges associated with other techniques to segregate network traffic. In most circumstances, it should be the most effective, low-effort, and scalable solution. However, it’s not always supported by all switches.
Configuring an access-list on your main switch is the conventional method to implement similar logic. However, it’s often avoided because it is more difficult to configure and can become unmanageable at scale. Configuring source-port filters is another alternative similar to access-list, but with the same drawbacks.
There’s no doubt that security officers and network admins are facing an uphill battle. However, implementing a PVLAN or alternative strategies can help reduce and manage risk across your organization’s network by logically segregating network assets and limiting exposure to outside sources. It just so happens that PVLANs hold a number of other benefits that also lower the logistical strain of managing a large-scale network.