Port-Security Trunk Port

SW2(config)#default interface fastEthernet 0/2
Interface FastEthernet0/2 set to default configuration

SW2(config)#int fas0/2
SW2(config-if)#switchport trunk encapsulation dot1q
SW2(config-if)#switchport mode trunk
SW2(config-if)#switchport port-security maximum 50 vlan 123
SW2(config-if)#switchport port-security violation restrict
SW2(config-if)#switchport port-security
SW2(config-if)#do show run in fas 0/2
!
interface FastEthernet0/2
 switchport trunk encapsulation dot1q
 switchport mode trunk
 switchport port-security maximum 50 vlan 123
 switchport port-security
 switchport port-security violation restrict
 shutdown
end

Cisco CCNP Switch Chapter 4

Static VLANs

#Create VLANs
Switch(config)# vlan 50
Switch(config-vlan)# name ROOM50

Switch# vlan database
Switch(vlan)# vlan 50 name ROOM50
VLAN 50 added:
Name: ROOM50

#Assign switch port to the VLAN
Switch(config)# interface fastEthernet 1/0
Switch(config-if)# switchport
Switch(config-if)# switchport mode access
Switch(config-if)# switchport access vlan 50

Switch# show vlan | include Fa1/0
50   ROOM50                           active    Fa1/0

Switch# show vlan-switch | include Fa1/0
50   ROOM50                           active    Fa1/0

Switch# show interfaces status | include 1/0
Port    Name               Status       Vlan       Duplex Speed Type
Fa1/0   PRINTER IN BLDG B, disabled     50           half      10 10/100BaseTX

Dinamic VLANs

#VMPS Configuration on Switch

!
vlan 10
 name IT
!
vtp domain mydomain
!
vmps server 192.168.3.2 primary
vmps reconfirm 60
vmps retry 3
!
interface fastethernet 0/1
 switchport mode access
 switchport access vlan dynamic
 no shutdown

*Note: When a port is configured as dynamic, the spanning-tree portfast feature is automatically configured on the port.

A sample VMPS Server Database (vlan.db) file looks like this:

#VMPS Server Configuration
!
vmps domain mydomain                    ! The VTP domain on the Client switch should match this domain name
vmps mode open                          ! This can be either Open or Secure mode
! vmps fallback <vlan-name>             ! Fallback VLAN in case no MAC address-to-VLAN match is made
! vmps no-domain-req { allow | deny }
!
vmps-mac-addrs
address 0022.19df.9252 vlan-name IT
!
vmps-port-policies vlan-name IT
device 192.168.100.10 port Fa 0/1       ! Device is the Switch here
!

#Verification: 

Switch# show vmps
VQP Client Status:
--------------------
VMPS VQP Version:   1
Reconfirm Interval: 60 min
Server Retry Count: 3
VMPS domain server: 192.168.3.2 (primary, current)
Reconfirmation status
---------------------
VMPS Action:         Success

Switch# show vlan | include IT
10   IT                               active    Fa0/1

#Trunk Configuration
Switch(config)# interface fastEthernet 1/1
Switch(config-if)# switchport
Switch(config-if)# switchport mode trunk
Switch(config-if)# switchport trunk encapsulation dot1q
Switch(config-if)# switchport trunk native vlan 10
Switch(config-if)# switchport trunk allowed vlan 1,1002-1005,20,50      ! (1,1002-1005  Reserved) 
Switch(config-if)# switchport nonegotiate                               ! Do not send or respond to DTP from this end

*Tricks
Switch(config-if)# switchport trunk allowed vlan 10-12,14-15
Or
Switch(config-if)# switchport trunk allowed vlan 10-15
Switch(config-if)# switchport trunk allowed vlan remove 13 

#Troubleshooting VLANs and Trunks

#Determining Switch Port Trunking Status
Switch# show interfaces fastEthernet 1/1 trunk

Port      Mode         Encapsulation  Status        Native vlan
Fa1/1     on           802.1q         not-trunking  10

#Determining Switch Port Status
Switch# show interfaces status
Port    Name               Status       Vlan       Duplex Speed Type
Fa1/0   PRINTER IN BLDG B, disabled     50           half      10 10/100BaseTX

#Verifying Switch VLAN Configuration
Switch# show vlan-switch id 50
VLAN Name                             Status    Ports
---- -------------------------------- --------- -------------------------------
50   ROOM50                           active    Fa1/0

#Comparing Switch Port Trunking Configuration and Active State
Switch#show interfaces fastEthernet 1/1 switchport
Name: Fa1/1
Switchport: Enabled
Administrative Mode: trunk
Operational Mode: down
Administrative Trunking Encapsulation: dot1q
Negotiation of Trunking: Disabled
Access Mode VLAN: 0 ((Inactive))
Trunking Native Mode VLAN: 10 (MGM)
Trunking VLANs Enabled: 1,20,50,1002-1005
Trunking VLANs Active: none
Priority for untagged frames: 0
Override vlan tag priority: FALSE
Voice VLAN: none
Appliance trust: none

Switch(config-if)# do show run inter fa 1/1
!
interface FastEthernet1/1
 switchport trunk native vlan 10
 switchport trunk allowed vlan 1,20,50,1002-1005
 switchport mode trunk
 shutdown
end

DTP Hack (Yersinia)

DTP Attack

To start DTP attack open Yersinia in Backtrack

root@bt:~# yersinia -G  (Grafic interface)
 
Click "Lunch Attack" and select DTP protocol 

in menu choose "Enabling Trunking" and click OK 


Before 



After 

Now we can recive traffic from any VLAN.

Make different interfacec per VLAN

Start  802.1q Encapsulation

root@bt:~# modprobe 8021q

root@bt:~# vconfig add eth0 101 (Where 101 is VLAN 101)
root@bt:~# vconfig add eth0 102 (Where 102 is VLAN 102)

Note: Its create Subinterfaces eth0.101,eth0.102

Set IP address for VLAN

root@bt:~# ifconfig eth0.101 10.0.101.111 netmask 255.255.255.0
root@bt:~# ifconfig eth0.102 10.0.102.111 netmask 255.255.255.0

Configure Default GW

root@bt:~# route add default gw 10.0.102.3

Check interfaces

root@bt:~# ifconfig
eth0      Link encap:Ethernet  HWaddr 00:21:85:96:10:4d  
          inet addr:10.0.10.111  Bcast:10.0.10.255  Mask:255.255.255.0
          inet6 addr: fe80::221:85ff:fe96:104d/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:2798550 errors:0 dropped:1828 overruns:0 frame:0
          TX packets:6565 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:224944578 (224.9 MB)  TX bytes:694407 (694.4 KB)
          Interrupt:42 Base address:0x6000 

eth0.101  Link encap:Ethernet  HWaddr 00:21:85:96:10:4d  
          inet addr:10.0.101.111  Bcast:10.0.101.255  Mask:255.255.255.0
          inet6 addr: fe80::221:85ff:fe96:104d/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:2779 errors:0 dropped:0 overruns:0 frame:0
          TX packets:6 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:146312 (146.3 KB)  TX bytes:468 (468.0 B)

eth0.102  Link encap:Ethernet  HWaddr 00:21:85:96:10:4d  
          inet addr:10.0.102.111  Bcast:10.0.102.255  Mask:255.255.255.0
          inet6 addr: fe80::221:85ff:fe96:104d/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:3506 errors:0 dropped:0 overruns:0 frame:0
          TX packets:547 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:514881 (514.8 KB)  TX bytes:42753 (42.7 KB)

Now We can Capture different VLAN traffic.