mcpField
C
configuring-network-segmentation-with-vlans

configuring-network-segmentation-with-vlans

github.com/mukul975安全35.2k124 次安装8 周前更新
代码仓库

关于 configuring-network-segmentation-with-vlans

用于规划和配置基于 VLAN 的网络隔离及跨 VLAN 控制的安全技能，指导网络团队加固交换机、设置路由和 DHCP，并验证隔离效果。

主要功能

  1. 01规划 VLAN 安全区域
  2. 02配置 802.1Q 中继
  3. 03加固交换机以防 VLAN 跳跃
  4. 04设置跨 VLAN 路由与 ACL
  5. 05配置各 VLAN 的 DHCP 和 DNS
  6. 06验证网络隔离效果

适用场景

  1. 01隔离企业、服务器、访客和 IoT 网络
  2. 02为 PCI-DSS 隔离支付系统
  3. 03减少网段之间的横向移动

安装

复制下面的命令，在终端中运行。

$npx skills add https://github.com/mukul975/anthropic-cybersecurity-skills --skill configuring-network-segmentation-with-vlans

安装后在 Claude Code 中输入/configuring-network-segmentation-with-vlans确认已加载。

包含的文件

除 SKILL.md 外，安装时一起下载的参考资料和脚本。

LICENSE
references/
api-reference.md
scripts/
agent.py

详细介绍

使用 VLAN 配置网络分段

何时使用

  • 将企业网络划分为隔离的安全区域（企业、服务器、DMZ、访客、IoT）
  • 满足对敏感数据强制要求网络隔离的合规要求（PCI-DSS、HIPAA、SOC 2）
  • 通过阻止网络分段之间的横向移动，缩小安全事件的影响范围
  • 将高风险设备（IoT、BYOD、遗留系统）与关键基础设施隔离
  • 通过将 VLAN 与防火墙规则和访问控制列表结合，实现纵深防御

不要在没有第 3 层过滤的情况下将 VLAN 作为唯一的安全控制，不要用于隔离需要物理隔离的网络，也不要在没有适当交换机加固以防范 VLAN 跳变攻击的情况下使用。

前提条件

  • 支持 802.1Q VLAN 中继的受管交换机（Cisco Catalyst、HP Aruba、Juniper EX 等）
  • 用于 VLAN 间路由和访问控制的第 3 层交换机或防火墙
  • 指定 VLAN 分配、IP 子网和流量要求的网络设计文档
  • 对交换机的控制台或 SSH 访问权限，并具有特权配置模式
  • 了解 802.1Q 中继、STP 和 VLAN 间路由概念

工作流

步骤 1：设计 VLAN 架构
# Define VLANs based on security zones and function

VLAN Plan:
  VLAN 10  - CORPORATE    (10.10.10.0/24)  - Employee workstations
  VLAN 20  - SERVERS      (10.10.20.0/24)  - Internal servers
  VLAN 30  - DMZ          (10.10.30.0/24)  - Internet-facing servers
  VLAN 40  - GUEST        (10.10.40.0/24)  - Guest WiFi
  VLAN 50  - IOT          (10.10.50.0/24)  - IoT/OT devices
  VLAN 60  - VOIP         (10.10.60.0/24)  - VoIP phones
  VLAN 100 - MANAGEMENT   (10.10.100.0/24) - Switch/AP management
  VLAN 999 - QUARANTINE   (10.10.99.0/24)  - Isolated/compromised hosts
  VLAN 998 - NATIVE_UNUSED                  - Native VLAN (no traffic)

# Traffic flow matrix:
# CORPORATE -> SERVERS: Allowed (specific ports)
# CORPORATE -> DMZ: Allowed (HTTP/HTTPS only)
# CORPORATE -> GUEST: Denied
# CORPORATE -> IOT: Denied
# GUEST -> Any Internal: Denied
# IOT -> SERVERS: Allowed (specific ports to specific hosts only)
# DMZ -> SERVERS: Allowed (database ports only)
# MANAGEMENT -> All: Allowed (from management stations only)
步骤 2：在 Cisco Catalyst 交换机上配置 VLAN
! Enter configuration mode
enable
configure terminal

! Create VLANs
vlan 10
  name CORPORATE
  exit
vlan 20
  name SERVERS
  exit
vlan 30
  name DMZ
  exit
vlan 40
  name GUEST
  exit
vlan 50
  name IOT
  exit
vlan 60
  name VOIP
  exit
vlan 100
  name MANAGEMENT
  exit
vlan 998
  name NATIVE_UNUSED
  exit
vlan 999
  name QUARANTINE
  exit

! Configure access ports for workstations (VLAN 10)
interface range GigabitEthernet1/0/1-24
  switchport mode access
  switchport access vlan 10
  switchport nonegotiate
  spanning-tree portfast
  spanning-tree bpduguard enable
  no shutdown
  exit

! Configure access ports for servers (VLAN 20)
interface range GigabitEthernet1/0/25-36
  switchport mode access
  switchport access vlan 20
  switchport nonegotiate
  spanning-tree portfast
  spanning-tree bpduguard enable
  no shutdown
  exit

! Configure trunk ports to other switches
interface GigabitEthernet1/0/48
  switchport mode trunk
  switchport trunk encapsulation dot1q
  switchport trunk native vlan 998
  switchport trunk allowed vlan 10,20,30,40,50,60,100
  switchport nonegotiate
  no shutdown
  exit

! Configure trunk to firewall/router
interface GigabitEthernet1/0/47
  switchport mode trunk
  switchport trunk encapsulation dot1q
  switchport trunk native vlan 998
  switchport trunk allowed vlan 10,20,30,40,50,60,100
  switchport nonegotiate
  no shutdown
  exit

! Shutdown unused ports
interface range GigabitEthernet1/0/37-46
  shutdown
  switchport mode access
  switchport access vlan 999
  exit
步骤 3：加固交换机以防范 VLAN 跳变
! Disable DTP on all ports (prevents switch spoofing)
interface range GigabitEthernet1/0/1-46
  switchport nonegotiate
  exit

! Set native VLAN to unused VLAN on all trunks
interface range GigabitEthernet1/0/47-48
  switchport trunk native vlan 998
  exit

! Enable DHCP Snooping
ip dhcp snooping
ip dhcp snooping vlan 10,20,30,40,50,60
interface GigabitEthernet1/0/47
  ip dhcp snooping trust
  exit

! Enable Dynamic ARP Inspection
ip arp inspection vlan 10,20,30,40,50,60
interface GigabitEthernet1/0/47
  ip arp inspection trust
  exit

! Enable IP Source Guard (prevents IP spoofing)
interface range GigabitEthernet1/0/1-36
  ip verify source
  exit

! Enable Port Security
interface range GigabitEthernet1/0/1-24
  switchport port-security
  switchport port-security maximum 2
  switchport port-security violation restrict
  switchport port-security aging time 60
  exit

! Set VTP to transparent mode (prevents VTP attacks)
vtp mode transparent

! Enable BPDU Guard globally
spanning-tree portfast bpduguard default

! Enable Storm Control
interface range GigabitEthernet1/0/1-36
  storm-control broadcast level 10
  storm-control multicast level 10
  storm-control action shutdown
  exit
步骤 4：使用 ACL 配置 VLAN 间路由
! On the Layer 3 switch or firewall, configure SVIs
interface Vlan10
  ip address 10.10.10.1 255.255.255.0
  no shutdown
  exit
interface Vlan20
  ip address 10.10.20.1 255.255.255.0
  no shutdown
  exit
interface Vlan30
  ip address 10.10.30.1 255.255.255.0
  no shutdown
  exit
interface Vlan40
  ip address 10.10.40.1 255.255.255.0
  no shutdown
  exit
interface Vlan50
  ip address 10.10.50.1 255.255.255.0
  no shutdown
  exit

! ACL: Corporate to Servers (allow specific services)
ip access-list extended CORP-TO-SERVERS
  permit tcp 10.10.10.0 0.0.0.255 10.10.20.0 0.0.0.255 eq 80
  permit tcp 10.10.10.0 0.0.0.255 10.10.20.0 0.0.0.255 eq 443
  permit tcp 10.10.10.0 0.0.0.255 10.10.20.0 0.0.0.255 eq 445
  permit udp 10.10.10.0 0.0.0.255 10.10.20.0 0.0.0.255 eq 53
  permit icmp 10.10.10.0 0.0.0.255 10.10.20.0 0.0.0.255 echo
  deny ip any any log
  exit

! ACL: Guest to Internet only (deny all internal)
ip access-list extended GUEST-OUTBOUND
  deny ip 10.10.40.0 0.0.0.255 10.0.0.0 0.255.255.255
  deny ip 10.10.40.0 0.0.0.255 172.16.0.0 0.15.255.255
  deny ip 10.10.40.0 0.0.0.255 192.168.0.0 0.0.255.255
  permit tcp 10.10.40.0 0.0.0.255 any eq 80
  permit tcp 10.10.40.0 0.0.0.255 any eq 443
  permit udp 10.10.40.0 0.0.0.255 any eq 53
  deny ip any any log
  exit

! ACL: IoT limited access
ip access-list extended IOT-OUTBOUND
  permit tcp 10.10.50.0 0.0.0.255 host 10.10.20.10 eq 443
  permit tcp 10.10.50.0 0.0.0.255 any eq 443
  permit udp 10.10.50.0 0.0.0.255 host 10.10.20.1 eq 53
  deny ip 10.10.50.0 0.0.0.255 10.10.50.0 0.0.0.255 log
  deny ip any any log
  exit

! Apply ACLs to VLAN interfaces
interface Vlan10
  ip access-group CORP-TO-SERVERS out
  exit
interface Vlan40
  ip access-group GUEST-OUTBOUND in
  exit
interface Vlan50
  ip access-group IOT-OUTBOUND in
  exit
步骤 5：为每个 VLAN 配置 DHCP 和 DNS
! DHCP pools for each VLAN
ip dhcp pool CORPORATE
  network 10.10.10.0 255.255.255.0
  default-router 10.10.10.1
  dns-server 10.10.20.10
  domain-name corp.example.com
  lease 1
  exit

ip dhcp pool GUEST
  network 10.10.40.0 255.255.255.0
  default-router 10.10.40.1
  dns-server 1.1.1.1 8.8.8.8
  lease 0 4
  exit

ip dhcp pool IOT
  network 10.10.50.0 255.255.255.0
  default-router 10.10.50.1
  dns-server 10.10.20.10
  lease 7
  exit

! Exclude gateway and server IPs from DHCP pools
ip dhcp excluded-address 10.10.10.1 10.10.10.10
ip dhcp excluded-address 10.10.40.1 10.10.40.10
ip dhcp excluded-address 10.10.50.1 10.10.50.10
步骤 6：验证并测试分段
# From a workstation on VLAN 10 (Corporate):
# Should succeed:
ping 10.10.20.10          # Server access
curl https://10.10.20.10  # HTTPS to server

# Should fail:
ping 10.10.40.100         # Guest VLAN - should be blocked
ping 10.10.50.100         # IoT VLAN - should be blocked

# From a device on VLAN 40 (Guest):
# Should succeed:
ping 8.8.8.8              # Internet access
curl https://www.google.com

# Should fail:
ping 10.10.10.1           # Corporate gateway - blocked
ping 10.10.20.10          # Server - blocked

# Verify switch configuration
show vlan brief
show interfaces trunk
show ip arp inspection statistics
show ip dhcp snooping binding
show port-security
show ip access-lists

# Run VLAN hopping tests (from authorized pentest)
# These should all fail if hardening is correct:
# 1. DTP negotiation - should fail (nonegotiate)
# 2. Double tagging - should fail (native VLAN 998)
# 3. ARP spoofing - should fail (DAI enabled)

关键概念

术语定义
VLAN（虚拟局域网）第 2 层的逻辑网络分区，将交换机端口划分为隔离的广播域，与物理位置无关
802.1Q 中继用于 VLAN 标记的 IEEE 标准，在以太网帧中添加 4 字节标头，跨中继链路标识帧所属的 VLAN
VLAN 间路由使用路由器、第 3 层交换机或带访问控制列表的防火墙在 VLAN 之间进行流量的第 3 层转发
本征 VLAN中继端口上分配给未标记帧的 VLAN；应设置为未使用的 VLAN，以防止 VLAN 跳变攻击
DHCP Snooping交换机功能，用于验证 DHCP 消息并构建 IP-MAC-端口映射的绑定表，防止恶意 DHCP 服务器
端口安全交换机功能，用于限制每个端口的 MAC 地址数量，并在违反时采取措施（关闭、限制）

工具与系统

  • Cisco Catalyst/Nexus：企业级受管交换机，全面支持 VLAN、中继和安全功能
  • HP Aruba CX：具有 REST API 管理和 VLAN 分段能力的企业级交换机
  • pfSense/OPNsense：开源防火墙，用于带状态访问控制的 VLAN 间路由
  • NetBox：开源 IPAM 和 DCIM 工具，用于记录 VLAN 分配、IP 寻址和网络拓扑
  • Nmap：网络扫描器，通过测试跨 VLAN 边界的可达性来验证分段有效性

常见场景

场景：为零售业实施符合 PCI-DSS 的网络分段

背景：一家零售连锁企业必须将支付卡处理系统与一般企业网络隔离，以满足 PCI-DSS 要求。当前的扁平网络将销售点终端、员工工作站、库存服务器和访客 WiFi 都放在同一个 VLAN 上。该环境使用 Cisco Catalyst 9300 交换机。

方法：

  1. 设计 VLAN 架构：POS 终端位于 VLAN 50（CDE），企业网络位于 VLAN 10，服务器位于 VLAN 20，访客位于 VLAN 40
  2. 在所有接入层交换机上创建 VLAN，并按功能配置接入端口
  3. 在交换机之间配置中继链路，并使用明确的 VLAN 允许列表（不使用“全部”中继）
  4. 将所有中继上的本征 VLAN 设置为 998（未使用），并在每个端口上禁用 DTP
  5. 在三层交换机上配置 ACL：CDE VLAN 只能通过端口 443 访问支付处理器的 IP；不允许其他进出 CDE 的 VLAN 间流量
  6. 在所有接入端口上启用 DHCP 侦听、DAI 和端口安全
  7. 从每个 VLAN 进行渗透测试以验证分段，确认 CDE 已完全隔离

陷阱：

  • 在接入端口上保留启用 DTP，允许 VLAN 跳跃以到达 CDE
  • 使用 VLAN 1 作为本征 VLAN，从而启用双重标记攻击
  • 不限制中继允许的 VLAN，将包括 CDE 在内的所有 VLAN 承载到非必要交换机
  • 创建的 ACL 允许“任意”源访问 CDE 服务器，而不是特定的 POS 终端 IP

输出格式

## Network Segmentation Implementation Report

**Network**: Retail Store #42
**Switch Platform**: Cisco Catalyst 9300
**VLANs Configured**: 8

### VLAN Summary

| VLAN ID | Name | Subnet | Ports | Purpose |
|---------|------|--------|-------|---------|
| 10 | CORPORATE | 10.10.10.0/24 | Gi1/0/1-24 | Employee workstations |
| 20 | SERVERS | 10.10.20.0/24 | Gi1/0/25-36 | Internal servers |
| 30 | DMZ | 10.10.30.0/24 | Gi2/0/1-4 | Internet-facing |
| 40 | GUEST | 10.10.40.0/24 | WiFi AP trunk | Guest WiFi |
| 50 | CDE | 10.10.50.0/24 | Gi2/0/5-12 | POS terminals |
| 100 | MGMT | 10.10.100.0/24 | Gi1/0/48 | Switch management |
| 998 | NATIVE | N/A | Trunks only | Unused native |
| 999 | QUARANTINE | 10.10.99.0/24 | Unused ports | Isolation |

### Security Hardening Status

| Control | Status |
|---------|--------|
| DTP Disabled (nonegotiate) | All ports |
| Native VLAN (998) | All trunks |
| DHCP Snooping | VLANs 10,20,40,50 |
| Dynamic ARP Inspection | VLANs 10,20,40,50 |
| Port Security | Access ports |
| BPDU Guard | Access ports |
| Unused Ports Shutdown | 10 ports in VLAN 999 |
| VTP Transparent Mode | Enabled |

评论

支持 Markdown