RFC 5517
Cisco Systems' Private VLANs: Scalable Security in a Multi-Client Environment
RFC 5517: Cisco Systems' Private VLANs: Scalable Security in a Multi-Client Environment 🦋
- Authors: S. HomChaudhuri and M. Foschiano, Cisco Systems
- Stream: Independent Submission
- Category: Informational
- ISSN: 2070-1721
- Date: February 2010
- Obsoletes / Updates: nothing listed in this header 💅
Abstract 🎀
okay so this doc is about a way to get device isolation using some special Layer 2 forwarding rules 🔥 The best part is that end devices can share the same IP subnet and still be Layer 2 isolated from each other. That means network designers can use bigger subnets, which cuts down on the address management overhead. it's giving efficiency 💖
There are a bunch of ways this mechanism gets used, from data center designs all the way to Ethernet-to-the-home-basement networks 🏠 The text mentions a few of these just to show what it can do, but the doc doesn't try to cover every deployment scenario or go deep into the details of each one. iykyk 🫶
Status of This Memo ✨
bestie, this one is not an Internet Standards Track spec. It's published for informational purposes 🌸
This is a contribution to the RFC Series, and it's independent of any other RFC stream. The RFC Editor picked to publish it at their discretion and makes no claims about how valuable it is for implementation or deployment. Documents the RFC Editor approves for publication are not candidates for any level of Internet Standard, see Section 2 of RFC 5741 for the details 📚
If you want the current status of this doc, any errata, or a way to send feedback, check out http://www.rfc-editor.org/info/rfc5517 🦋
Copyright Notice 🌈
Copyright (c) 2010 IETF Trust and the persons identified as the document authors. All rights reserved.
This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) as they stand on the date this document was published. Please actually read these, because they spell out your rights and restrictions for this document 👀
Table of Contents 💜
1. Introduction ....................................................2
1.1. Security Concerns with Sharing a VLAN ......................3
1.2. The Traditional Solution and Its Related Problems ..........3
2. Private VLANs Architecture ......................................4
2.1. VLAN Pairings and Their Port-Related Characteristics .......7
3. Extending Private VLANs across Switches .........................9
4. A More Flexible IP Addressing Scheme ............................9
5. Routing Considerations .........................................10
6. Security Considerations ........................................10
7. Acknowledgements ...............................................11
8. References .....................................................11
8.1. Normative References ......................................11
8.2. Informative References ....................................111. Introduction ✨
okay so in an Ethernet switch, a VLAN is a broadcast domain, which means hosts can talk directly to each other at Layer 2 💬 The catch is that if you drop untrusted devices into a VLAN, you can get security problems, because the trusted and untrusted devices are now sharing the same broadcast domain 😬
The traditional fix is to give every user who cares about Layer 2 security their own VLAN. Here's the snag though: the IEEE 802.1Q standard [802.1Q] says the VLAN ID field in an Ethernet frame is 12 bits wide. That gives a theoretical max of 4094 VLANs, since VLAN numbers 0 and 4095 are reserved 🙃 So if the admin does one VLAN per user, that caps things at 4094 users. Not a lot when you're trying to scale! 💀
That's the scalability problem this memo tackles. Private VLANs give you more granular and more flexible Layer 2 segregation, and the next sections explain how 🦋
1.1. Security Concerns with Sharing a VLAN
Companies with an Internet presence have two choices: host their servers on their own premises, or put them at the Internet Service Provider's premises. A typical ISP runs a server farm that offers web hosting for a bunch of customers. Co-locating servers in a farm is super easy to manage, but it can also raise security concerns 🏢
Picture this: the ISP puts every server into one big VLAN. Servers in the same VLAN can hear Layer 2 broadcasts from each other 👂 Once a server learns the Media Access Control (MAC) address tied to another machine's IP address in that VLAN, it can talk to that device directly at Layer 2, without going through a Layer 3 gateway or firewall. So if an attacker gets into one server, they can use that box to attack the other servers in the farm 😱 To stay safe, ISP customers want their machines isolated from everyone else's machines in the same farm 🔒
It gets even messier in metropolitan area networks. Metropolitan Service Providers may want to give Layer 2 Ethernet access to homes, rental communities, businesses and so on. In that setup, the neighbour next door could easily be a malicious network user 🫣
So Layer 2 traffic isolation between customers is a must. Customer A doesn't want their Layer 2 frames broadcast to customer B, even though B is in the same VLAN. Customer A also doesn't want customer B to skip a router or firewall and set up direct Layer 2 communication with them 🚫
1.2. The Traditional Solution and Its Related Problems
The traditional approach is to give each customer their own VLAN. That way, every user has Layer 2 isolation from devices belonging to other users 🧚
But with the VLAN-per-customer model, if an ISP wants to offer web hosting to, say, 4000 customers, that eats up 4000 VLANs 📉 In theory, an 802.1Q-compliant networking device can support up to 4094 VLANs. In practice, plenty of devices support a much smaller number of active VLANs. Even if every device could handle all 4094, you'd still hit a scalability wall when the 4095th customer signs up 💔
There's also a second problem with a separate VLAN per customer: managing IP addresses. Each VLAN needs its own subnet, so there can be wasted IP addresses in every one of those subnets. RFC 3069 [RFC3069] describes this issue, and this document won't go into detail on it 🌸
2. Private VLANs Architecture ✨
okay so the private VLANs architecture is basically the aggregated VLAN model from RFC 3069 but make it extra 💅. The "super VLAN" and "sub VLAN" from that RFC are functionally similar to the "primary VLAN" and "secondary VLAN" we use in this document, so you've already got the vibe 🦋
It's not the same as the mechanism in [RFC4562] though! That one uses a MAC-address-based 'forced forwarding' scheme, and private VLANs go with a VLAN-based one instead. Different approach, same goal 🌸
Here's the core idea: a regular VLAN is one single broadcast domain. Private VLANs take a big VLAN broadcast domain and chop it into smaller sub-domains. Right now there are two special kinds defined just for this tech: an 'isolated' sub-domain and a 'community' sub-domain. Each sub-domain is set up by giving a designation to a group of switch ports 🎀
Inside a private VLAN domain, there are three separate port designations, and each one has its own rules for what a connected endpoint is allowed to talk to. The three are promiscuous, isolated, and community. Iconic trio, no notes 👑
Promiscuous ports: An endpoint on a promiscuous port can communicate with any endpoint in the private VLAN. You can have more than one promiscuous port in a single private VLAN domain. In most networks, Layer 3 default gateways or network management stations are usually plugged into promiscuous ports. Main character energy for the gateway 👑
Isolated ports: These are typically for endpoints that only need to reach a few outgoing interfaces on a private-VLAN-enabled device. An endpoint on an isolated port can only talk to endpoints on promiscuous ports. Endpoints on adjacent isolated ports can't talk to each other, so no sneaky chats 🙈 For example, in a web-hosting setup, isolated ports can connect hosts that only need to reach default gateways. Very contained, very safe 🧚
Community ports: A community port belongs to a private VLAN community, which is a grouping of ports connected to devices from the same entity. Think a group of hosts belonging to one ISP customer, or a pool of servers in a data center 💜 Endpoints inside a community can talk to each other and can also talk to any configured promiscuous port. But endpoints in one community can't talk to endpoints in a different community, or to endpoints on isolated ports. Friend group vibes, but with boundaries 🫶
Those three port designations line up directly with three VLAN types: primary, isolated, and community. Each one has well-defined, port-related characteristics, and we go through them in detail in Section 2.1 below 🌈
Figure 1 shows the private VLAN model from a switch port classification point of view. Take a look:
-----------
| R |
-----------
|
|
|
----------------------------------------
| p1 |
| |
=====| t1 |
| switch |
| |
| |
|i1 i2 c1 c2 |
----------------------------------------
| | | |
| | | |
| | | |
A B C D
A, B - Isolated devices
C, D - Community devices
R - Router (or other L4-L7 device)
i1, i2 - Isolated switch ports
c1, c2 - Community switch ports
p1 - Promiscuous switch port
t1 - Inter-switch link port (a VLAN-aware port)
Figure 1. Private VLAN classification of switch portsNow let's go through each port type with reference to Figure 1 🎀
Isolated ports: An isolated port, like i1 or i2, can't talk to any other port in the private VLAN domain except promiscuous ports (like p1). If a customer device only needs access to a gateway router, it should be attached to an isolated port 💅
Community ports: A community port, like c1 or c2, is part of a group of ports. The ports in a community can have Layer 2 communications with each other, and they can also talk to any promiscuous port. Say an ISP customer has 2 devices they want isolated from other customers' devices but still able to chat with each other. Then community ports should be used 👯♀️
Promiscuous ports: As the name suggests, a promiscuous port (p1) can talk to all other types of ports. It can talk to isolated ports and community ports, and vice versa. Layer 3 gateways, DHCP servers, and other 'trusted' devices that need to communicate with customer endpoints are typically connected via promiscuous ports 👑
Quick note: isolated, community, and promiscuous ports can each be either access ports or hybrid/trunk ports. This follows the terminology in Annex D of the IEEE 802.1Q specification, up to its 2004 revision 🧾
Here's a table that sums up the communication privileges between the different private VLAN port types. Screenshot it, bestie 📸
---------------------------------------------------------------
| | isolat-| promis-| commu-| commu-| interswitch |
| | ted | cuous | nity1 | nity2 | link port |
---------------------------------------------------------------
| isolated | deny | permit | deny | deny | permit |
---------------------------------------------------------------
| promiscuous | permit | permit | permit| permit| permit |
---------------------------------------------------------------
| community1 | deny | permit | permit| deny | permit |
---------------------------------------------------------------
| community2 | deny | permit | deny | permit| permit |
---------------------------------------------------------------
| interswitch | | | | | |
| link port | deny(*)| permit | permit| permit| permit |
---------------------------------------------------------------Table 1 💜
Okay, now the asterisk, because this one is kind of a plot twist ✨ (*) Please note that this asymmetric behavior is only for traffic traversing inter-switch link ports over an isolated VLAN. Traffic going from an inter-switch link port to an isolated port gets denied if it's in the isolated VLAN. But if that same traffic is in the primary VLAN, it's permitted. We'll cover the different VLAN characteristics below, so hold that thought 🦋
And a quick N.B. because it matters: an inter-switch link port is just a regular port that connects two switches, and it happens to carry two or more VLANs 🌸
2.1. VLAN Pairings and Their Port-Related Characteristics 🎀
okay so the Layer 2 communication rules from that table above can be enforced by making sub-domains inside the same VLAN domain 💅 but here's the catch: a sub-domain can't really be built with just one VLAN ID. so instead we pair VLAN IDs together. sub-domains are represented by pairs of VLAN numbers:
<Vp,Vs> Vp is the primary VLAN ID ------
Vs is the secondary VLAN ID | Vp |
------
where Vs can be: / \
- Vi (an isolated VLAN) / \
- Vc (a community VLAN) / \
------ ------
| Vi | | Vc |
------ ------
<Vp,Vi> <Vp,Vc>
Figure 2. A private VLAN domain can be
implemented with one or more VLAN ID pairs.bestie, every private VLAN domain is built with at least one pair of VLAN IDs. you get one (and only one) primary VLAN ID (Vp) 👑 plus one or more secondary VLAN IDs (Vs). and secondaries come in two flavors: isolated VLANs (Vi) or community VLANs (Vc) 🦋
a primary VLAN is the unique, shared VLAN identifier for the whole private VLAN domain and every one of its VLAN ID pairs. it's the main character of the whole setup ✨
an isolated VLAN is a secondary VLAN where all the hosts plugged into its ports are isolated at Layer 2. this is the iconic part: a private VLAN design only needs two VLAN identifiers total (aka one single pairing) to give port isolation and serve any number of end users 🙌 compare that to a traditional design, where every single port gets its own plain VLAN ID. not it 💀
a community VLAN is a secondary VLAN tied to a group of ports that connect to a certain "community" of end devices that already trust each other 🫶
only one isolated VLAN is allowed in a private VLAN domain, but there can be multiple distinct community VLANs. so one isolated, as many communities as you want 🌈
quick note on tagging: this pairing scheme just needs all traffic in the primary and secondary VLANs to be tagged according to IEEE 802.1Q (see for example [802.1Q], Section B.1.3), with at most a single standard VLAN tag. no special double-tagging needed, because each secondary VLAN has a 1:1 correspondence with its primary. no extra layers, no drama 🧚
(also fyi, this doc uses the "traditional" VLAN terminology, but the IEEE 802.1ag standard [802.1ag] amends key sections of IEEE 802.1Q-2005 to split "VLANs" and "VLAN IDs" apart, so that every "VLAN" can get one or more VLAN IDs. kinda like the pairing scheme we're talking about 🤓)
the ports in a private VLAN domain get their special powers from the VLAN pairing(s) they're configured with (as described in Section 2). specifically, a promiscuous port can talk to every other private VLAN port type through the primary VLAN and any associated secondary VLANs. meanwhile isolated or community ports can only talk over their own secondary VLANs 🎀
for example, looking at Figure 1: a router R plugged into the promiscuous port can have Layer 2 communication with device A on an isolated port, and also with device C on a community port. devices C and D can also talk at Layer 2 with each other, since they're in the same community VLAN 💜 but A and B? nope, they can't talk at Layer 2 because of the special port segregation property of the isolated VLAN 🙅♀️ and A and C can't either, since they belong to different secondary VLANs.
so what's the impact of these enforced forwarding restrictions? two big things 🔥 first, service providers can assign multiple customers to the same isolated VLAN, which saves VLAN IDs. second, end users get peace of mind that their Layer 2 traffic can't be sniffed by other end users sharing that same isolated VLAN or hanging out on a different secondary VLAN 👀
3. Extending Private VLANs across Switches ✨
some switch vendors tried to offer a port isolation feature inside a VLAN by putting special logic at the port level. the catch? when it's done at the port level, the isolation behavior only works on a single switch 😭
when a VLAN spans multiple switches, there's no standard way to pass port-level isolation info to the other switches. so the isolation just falls apart on those other switches. not iconic.
so this document proposes doing it differently: put the isolation info implicitly at the VLAN level 💖 a particular VLAN ID can be configured to be the isolated VLAN, and every switch in the network gives frames tagged with that VLAN ID the special "isolated VLAN" treatment. that way, the isolated VLAN behavior stays consistent across all switches in a Layer 2 network 🌸
in general, isolated, community, and primary VLANs can all span multiple switches, just like regular VLANs do. inter-switch link ports don't need to know about the special VLAN type. they carry frames tagged with these VLANs just like any other frames 🦋
one of the main goals of the private VLANs architecture is making sure traffic from an isolated port on one switch doesn't reach another isolated or community port on a different switch, even after it goes across an inter-switch link 🚫 by embedding the isolation info at the VLAN level and carrying it along with the packet, the behavior stays consistent through the whole network. so the mechanism from Section 2, which restricts Layer 2 communication between two isolated ports on the same switch, also restricts Layer 2 communication between two isolated ports on two different switches 🙌
4. A More Flexible IP Addressing Scheme 🦋
deploying multiple VLANs for security reasons, and giving each VLAN its own subnet, is super common. but it leads to some inefficiencies in network designs, like poor use of the IP addressing space (as the introduction of RFC 3069 [RFC3069] shows). and here's the annoying part: every subnet needs addresses set aside for internetworking stuff (a subnetwork address, a directed broadcast address, default gateway address(es), and so on). so lots of VLANs usually means lots of special addresses getting eaten 😩
in a private VLAN domain though, all the members can share one common address space that lives in a single subnet tied to the primary VLAN 🫧 an end device can get its IP address statically, or from a DHCP server plugged into a promiscuous port.
since IP addresses aren't handed out per tiny subnet anymore and instead come from a bigger pool shared by all members of the private VLAN domain, address allocation gets way more efficient. fewer addresses go to internetworking purposes, most of the space goes to end devices, and you get loads of flexibility in how the available addresses get (re-)assigned 💅
5. Routing Considerations 🗺️
the whole private VLANs architecture keeps secondary VLANs locked inside the 2nd layer of the OSI model 🔒 looking at Figure 2, the secondary VLANs are internal to a private VLAN domain. Layer 3 entities aren't directly aware they exist. from their point of view, it looks like all the end devices are part of the primary VLAN 👀
now with Figure 1: the isolation between devices A and B is at the Layer 2 level only. A and B can still communicate at Layer 3 through the router R. since A and B are part of the same subnet, the router assumes they should be able to talk directly to each other. but the isolated VLAN's special behavior blocks that. so, to get A and B talking through the router, you need some proxy-ARP-like functionality supported on the router interface 🤝
about IP versions: all of these routing considerations apply to both IPv4 and IPv6 for unicast traffic. multicast bridging and routing within a private VLAN domain, though? too complex for this intro document, so those are left out 🙈
6. Security Considerations 🚨
okay this part is serious, bestie 😤 in a heterogeneous Layer 2 network built with switches from multiple vendors, the private VLAN feature should be supported and configured on all the switches. if a switch S in that network doesn't support this feature, undesired forwarding of packets can happen, including permanent flooding of Layer 2 unicast frames 💀 that's because switch S isn't aware of the association between primary and secondary VLANs, so it can't apply the segregation rules and constraints of the private VLANs architecture (one example of such a constraint is explained in [802.1Q], Section B.1.3). the good news: this impact is limited to traffic within the private VLAN domain and won't affect regular Layer 2 forwarding on other VLANs 🫶
now, if the private VLAN feature is properly deployed, it can segregate individual users or groups of users from each other at Layer 2. this lets a network designer tightly constrain Layer 2 forwarding, so they can block or contain unwanted inter-device communication like port scans or Address Resolution Protocol (ARP) poisoning attacks 🛡️✨
7. Acknowledgements 🫶
so many people helped shape the private VLANs architecture 💖 the authors would particularly like to thank, in alphabetical order, Senthil Arunachalam, Jason Chen, Tom Edsall, Michael Fine, Herman Hou, Kannan Kothandaraman, Milind Kulkarni, Heng-Hsin Liao, Tom Nosella, Prasanna Parthasarathy, Ramesh Santhanakrishnan, Mukundan Sudarsan, Charley Wen, and Zhong Xu for their significant contributions 👑
8. References 📚
8.1. Normative References
[802.1Q] Institute of Electrical and Electronics Engineers, "Virtual Bridged Local Area Networks", IEEE Standard 802.1Q, 2005 Edition, May 2006.
[802.1ag] Institute of Electrical and Electronics Engineers, "Connectivity Fault Management", IEEE Standard 802.1ag, 2007 Edition, December 2007.
8.2. Informative References
[RFC3069] McPherson, D. and B. Dykes, "VLAN Aggregation for Efficient IP Address Allocation", RFC 3069, February 2001.
[RFC4562] Melsen, T. and S. Blake, "MAC-Forced Forwarding: A Method for Subscriber Separation on an Ethernet Access Network", RFC 4562, June 2006.
Authors' Addresses 💌
Marco Foschiano
Cisco Systems, Inc.
Via Torri Bianche 7
Vimercate, MI, 20059, Italy
EMail: foschia@cisco.com; mfoschiano@gmail.com
Sanjib HomChaudhuri
EMail: sanjibhc@gmail.com📦 where this page comes from
- ietf: rfc5517 2010-02
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms