Examkin

Soru

Zorluk: Çok zorVLAN Configuration and 802.1Q Trunking

A network engineer connects two enterprise switches, `SW-BuildingA` and `SW-BuildingB`, over interface `GigabitEthernet0/12`. The switchport configurations are as follows:

SW-BuildingA (Gi0/12):
text
switchport mode trunk
switchport trunk native vlan 50
switchport trunk allowed vlan 10,20,50

SW-BuildingB (Gi0/12):
text
switchport mode trunk
switchport trunk native vlan 10
switchport trunk allowed vlan 10,20,30

A host connected to an access port in VLAN 50 on `SW-BuildingA` transmits an untagged broadcast frame destined for its local subnet. Which of the following best describes the processing and flow of this frame as it travels to `SW-BuildingB`?

  1. SW-BuildingA transmits the frame untagged across the trunk link; SW-BuildingB receives it untagged, classifies it into VLAN 10, and forwards it to VLAN 10 ports.Cevap
  2. B
    SW-BuildingA inserts an 802.1Q tag for VLAN 50 before transmission; SW-BuildingB drops the frame upon arrival because VLAN 50 is not in its allowed VLAN list.
  3. C
    SW-BuildingA transmits the frame untagged; SW-BuildingB drops the frame because its ingress native VLAN (VLAN 10) does not match the source switch's native VLAN (VLAN 50).
  4. D
    SW-BuildingA tags the frame with VLAN 50, and SW-BuildingB automatically routes the frame into VLAN 10 via its internal Layer 3 forwarding table.

Cevap

SW-BuildingA transmits the frame untagged across the trunk link; SW-BuildingB receives it untagged, classifies it into VLAN 10, and forwards it to VLAN 10 ports.
Under IEEE 802.1Q trunking specifications, frames belonging to the trunk's configured native VLAN are egressed without a VLAN tag header. SW-BuildingA has native VLAN 50 configured, so it transmits the VLAN 50 broadcast frame untagged. Upon receiving an untagged frame on trunk port Gi0/12, SW-BuildingB associates the frame with its own local native VLAN configuration (VLAN 10). Because VLAN 10 is in SW-BuildingB's allowed VLAN list, the frame is accepted and forwarded into VLAN 10, resulting in cross-VLAN traffic leakage.

Adım Adım Çözüm

1
Analyze frame egress at SW-BuildingA
The originating host sends an untagged broadcast frame in VLAN 50. Port Gi0/12 on SW-BuildingA has native VLAN set to 50. Under standard IEEE 802.1Q trunking, traffic belonging to the native VLAN is egressed without an 802.1Q VLAN header (untagged).
802.1Q trunking rules dictate that frames matching the interface's native VLAN are sent untagged across the link.
2
Analyze frame ingress at SW-BuildingB
The untagged frame travels across the physical link and arrives at SW-BuildingB interface Gi0/12.
No tag was added by SW-BuildingA during egress.
3
Determine ingress VLAN assignment on SW-BuildingB
SW-BuildingB inspects the incoming frame, sees no 802.1Q tag, and maps the untagged frame to its own configured native VLAN for interface Gi0/12, which is VLAN 10.
When an 802.1Q trunk port receives an untagged frame, it automatically assigns that frame to its local native VLAN.
4
Verify VLAN allowed list processing
VLAN 10 is listed in SW-BuildingB's allowed list (`allowed vlan 10,20,30`), so SW-BuildingB processes the frame and floods it to all active access ports in VLAN 10.
Because VLAN 10 is allowed on SW-BuildingB's trunk, the frame is accepted and forwarded into VLAN 10, leaking traffic between VLAN 50 (Building A) and VLAN 10 (Building B).

Anahtar Kavram

IEEE 802.1Q Native VLAN Tagging Behavior and Native VLAN Mismatch Security Risks
Tahmini Süre:2m 0s
Bu soruyu puanla

Konular

VLAN Configuration and 802.1Q Trunking

Bu konudan daha fazla soru