Build Your Own Cybersecurity Testing Lab: Low-cost Solutions for Testing in Virtual and Cloud-based Environments by Ric Messier

Author:Ric Messier [Ric Messier]
Language: eng
Format: epub, pdf
Publisher: McGraw-Hill
Published: 2020-02-27T16:00:00+00:00

Figure 6-6 VLAN ID in Windows network settings

You won’t always be able to do this, though. This is a function of the driver and not of Windows. If your network interface and the driver for that network interface don’t support tagging, you won’t see that as an option. For instance, looking at the network interface on a virtual machine in VMware ESXi, there is no VLAN ID option. This is on an Intel interface, which is what’s being presented inside of the operating system from the hypervisor. The driver in Windows 10 for that particular interface doesn’t support VLAN tagging from the interface. If your interface doesn’t support it and you really want to do VLAN tagging, you should be able to switch interfaces. Even in VMware, you have an option of different interfaces, some of which may support VLAN tagging. If you have physical systems, you may need to get a different interface card, or add another interface card on top of the onboard card that came with the motherboard.

You can consider where you want your VLANs to be tagged. You might argue that the endpoints should never know what VLAN it’s on and all of that should be handled by the switch. This is probably the correct way to think about it, but in a smaller environment, it may make some sense to be tagging on the endpoint. There are multiple reasons for this. You may want your devices to connect to a particular VLAN based on their configuration rather than on the switch configuration, since different devices may plug into the same switch port at different times.

One place I have seen this to be true is when there is a separate VLAN for voice traffic when the business was using Voice over IP (VoIP). The phone identifies which network/VLAN it is on when it connects and starts tagging traffic accordingly. A desktop or laptop computer could also plug into the same switch port and be placed on the normal business network. There are surely other cases where devices should be making their own decisions. Rather than having to have all devices configure themselves, it’s usually easier and probably a better security practice to determine which VLAN a device is in at the switch. This allows you to better segment your devices and traffic.

Download

Copyright Disclaimer:
This site does not store any files on its server. We only index and link to content provided by other sites. Please contact the content providers to delete copyright contents if any and email us, we'll remove relevant links or contents immediately.