Your VLANs are segmented. Your attacker is already hopping between them.
Network segmentation is one of the most cited controls in modern architecture. It is also one of the most consistently misconfigured.
The same switches that segment your network can be turned against every boundary they create.
What VLAN segmentation is supposed to do: VLANs create isolated broadcast domains at Layer 2. Finance stays separate from operations. IoT cannot reach Active Directory. Four overlooked configurations tear that isolation apart.
Where it breaks down
- DTP — DYNAMIC TRUNKING PROTOCOL Cisco switches negotiate trunk links by default. An attacker sends one DTP frame and the port elevates to trunk mode. Every VLAN becomes reachable — instantly. No credentials required. Just a packet.
- NATIVE VLAN 1 VLAN 1 is the default native VLAN on every 802.1Q trunk. Untagged traffic rides it silently. If management interfaces and trunk links share VLAN 1, any adversary on an unmanaged port has a direct path to your core infrastructure.
- DOUBLE TAGGING With the native VLAN unchanged, an attacker crafts a double-tagged 802.1Q frame. The first tag strips at ingress. The second delivers the payload into a restricted VLAN. One-way — but enough for reconnaissance and injection.
- PRIVATE VLAN MISUSE Private VLANs isolate hosts within the same subnet using promiscuous, isolated, and community ports. Misconfigured promiscuous assignments — especially on hypervisors — let traffic cross hosts that should never communicate.
- INTER-VLAN ROUTING EXPOSURE Routing between VLANs requires a Layer 3 boundary. Overly permissive ACLs on that boundary mean segmentation exists at Layer 2 and collapses at Layer 3. The VLAN exists. The isolation does not.
Real consequences: In a 2025 red team exercise, testers entered via an unmanaged guest port at a European manufacturer. DTP was active. Within four minutes, the port became a trunk. Within twelve, testers reached the OT network. The VLAN boundary had never been tested. It did not hold.
How to fix it
DISABLE DTP — Set all access ports to static mode. switchport nonegotiate is not optional.
CHANGE THE NATIVE VLAN — Assign an unused VLAN as native on every trunk. Tag everything explicitly.
AUDIT L3 BOUNDARIES — Every inter-VLAN rule should be an explicit permit. Default deny. Log anomalies.
PRIVATE VLAN REVIEW — Validate promiscuous port assignments quarterly. Every hypervisor uplink is a risk.
VLAN 1 HYGIENE — Move all management interfaces off VLAN 1. Treat it as permanently untrusted.
Segmentation is not a one-time configuration. It is an operational discipline.
A VLAN that has never been validated under attack is not a control. It is a false assumption.
When did you last verify your VLAN boundaries under real attack conditions?