Re: Better way to do VLAN in Linux

Additionally, be sure to check with various online resources (i.e. 
Bugtraq) regarding the switch's vulnerability to VLAN hopping and apply 
appropriate methods/patches/etc. available to mitigate this risk.

Remember, VLANs aren't a security "magic bullet".  They help, to be 
sure, and PVLANs are better, but neither are as good as physically 
isolating LANs on their own switches.

Kind Regards,
-dsp

Jose Maria Lopez wrote:

> El jue, 26 de 08 de 2004 a las 14:18, Kidder, Roy escribiÃ:
>
> > The Linux kernel supports 802.1Q, so your router could support a VLAN
> > trunk on its Ethernet interface. However, I'm pretty sure that you'll
> > have to have layer 2 devices that will also support 802.1Q to take
> > full advantage of that. 
>
>
> Thanks for the advice. I received another message saying something
> similar. What I have understood more or less it's I need a VLAN aware
> switch and then the kernel module for the Ethernet interface trunk. Now
> I have quite clear how to do it. I will be trying it
> when I end my vacation.
>
> I found some more documentation at google, so I will read it as soon
> as I can.
>
>
> > -----Original Message-----
> > From: Jose Maria Lopez [mailto:jkerouac@bgsec.com] 
> > Sent: Monday, August 23, 2004 4:38 PM
> > To: firewalls@securityfocus.com
> > Subject: Better way to do VLAN in Linux
> >
> > I'm trying to implement a VLAN with a Linux router
> > and I would like to know your opinion about which one
> > is the best option to do it. The Linux router is
> > connected to two switches without VLAN funcionality.
> >
> > My main problem is my users have Linux machines with
> > root privileges and can change their IPs and MACs, but
> > I am also interested in the case the users can't change
> > their IPs and MACs.
> >
> > I'm trying it with the iproute2 tools and tunnels but
> > I have a lot of problems.
> >
> > Thanks in advance.
> >
> > --
> > Jose Maria Lopez Hernandez
> > Director Tecnico de bgSEC
> > jkerouac@bgsec.com
> > bgSEC Seguridad y Consultoria de Sistemas Informaticos
> > http://www.bgsec.com
> > ESPAÃA
> >
> > The only people for me are the mad ones -- the ones who are mad to
> > live,
> > mad to talk, mad to be saved, desirous of everything at the same time,
> > the ones who never yawn or say a commonplace thing, but burn, burn,
> > burn
> > like fabulous yellow Roman candles.
> >                -- Jack Kerouac, "On the Road"
> >
> >
> > *************************************************************
> > This message, including any attachments, may contain
> > confidential information intended for a specific individual
> > and purpose, and may be protected by law.  If you are not
> > the intended recipient, please notify the sender by e-mail
> > or telephone immediately, and then immediately delete this
> > message.  Any disclosure, copying or distribution of this
> > message, or the taking of any action based on it, by any
> > unintended recipient is strictly prohibited.