What must be added to VLANs to improve security?

VLANs provide security by segmenting a network into distinct logical broadcast domains, isolating traffic at Layer 2. However, to control traffic that must be routed between these different VLANs, a Layer 3 device (such as a multilayer switch or a router) is necessary. Access Control Lists (ACLs) are applied to the Layer 3 interfaces of this device to filter inter-VLAN traffic. ACLs contain rules that permit or deny packets based on criteria like source/destination IP addresses and port numbers, thereby enforcing a security policy and ensuring that only authorized communication can occur between the segmented networks.

A. Network hubs: These are obsolete Layer 1 devices that broadcast all traffic to all ports, which would break VLAN segmentation and severely degrade security.

B. Air gaps: This refers to the physical isolation of a network, which is a different and more extreme security measure than the logical segmentation provided by VLANs.

C. Spanning tree interfaces: Spanning Tree Protocol (STP) is a Layer 2 protocol designed to prevent switching loops in redundant network topologies, not to filter traffic for security purposes.

---

1. Official Vendor Documentation: Cisco Systems

"Configuring IP Access Lists

" IP Routing: BGP Configuration Guide

Cisco IOS XE Gibraltar 16.12.x. This guide explains that ACLs are used to "provide a basic level of security for network access by controlling traffic that is permitted to enter or exit a network." This principle is directly applied to the Layer 3 interfaces (Switched Virtual Interfaces or SVIs) that route traffic between VLANs.

2. Academic Courseware: Balakrishnan

H.

& Rexford

J. (2009). Lecture 11: Switching. MIT OpenCourseWare

6.829 Computer Networks. The lecture notes discuss how VLANs create separate broadcast domains and that a router is needed to forward traffic between them. This routing function is the point where filtering policies (ACLs) are applied to control inter-VLAN communication for security.

3. Peer-Reviewed Academic Publication (Textbook): Kurose

J. F.

& Ross

K. W. (2021). Computer Networking: A Top-Down Approach (8th ed.). Pearson. In Chapter 5

Section 5.4

"Link-Layer Switches

" the text explains VLANs. In Chapter 8

"Security in Computer Networks

" Section 8.6 discusses firewalls and ACLs as the primary mechanism for filtering traffic between different network segments

which is the role VLANs create.