Blackhole VLAN

Nerd Cafe

A Blackhole VLAN is a security measure used in network environments to isolate unused switch ports and prevent unauthorized access or malicious attacks. This VLAN ensures that no traffic from those ports reaches the rest of the network.

Step 1: Understanding Blackhole VLAN

What is a Blackhole VLAN?

• A VLAN (Virtual LAN) used to isolate unused switch ports.

• Prevents unauthorized devices from connecting and accessing network resources.

• Configured on access ports to drop all traffic.

• No Layer 3 (IP) interface is assigned to this VLAN.

Step 2: Practical Scenario

Company Network Setup:

• A company has a Layer 2 switch with several unused ports.

• Some employees try to plug in personal devices into those ports.

• The network administrator wants to ensure that any unauthorized connection is blocked using a Blackhole VLAN.

Step 3: Lab Configuration on Cisco Switch

Step 3.1: Create the Blackhole VLAN

• Connect to the switch via CLI (Command Line Interface).

• Enter privileged EXEC mode:

Switch>enable 
Switch#

• Enter global configuration mode:

Switch#configure terminal 
Switch(config)#

• Create a VLAN (e.g., VLAN 999 as Blackhole VLAN):

Switch(config)#vlan 999
Switch(config-vlan)#name Blackhole_VLAN

Step 4: Assign Unused Ports to Blackhole VLAN

• Identify unused switch ports (e.g., FastEthernet 0/3 to 0/24).

• Assign these ports to VLAN 999:

Switch(config)#interface range fastEthernet 0/3-24
Switch(config-if-range)#switchport mode access 
Switch(config-if-range)#switchport access vlan 999
Switch(config-if-range)#shutdown 

• This ensures that no traffic from these ports can access the network.

• Shutting down the ports adds an extra layer of security.

Step 5: Ensure VLAN 999 is Not Routed

• Verify VLAN 999 does not have an SVI (Switched Virtual Interface):

Switch#show ip interface brief
Interface              IP-Address      OK? Method Status                Protocol
 
FastEthernet0/1        unassigned      YES manual up                    up
 
FastEthernet0/2        unassigned      YES manual up                    up
 
FastEthernet0/3        unassigned      YES manual administratively down down
 
FastEthernet0/4        unassigned      YES manual administratively down down
 
FastEthernet0/5        unassigned      YES manual administratively down down
 
FastEthernet0/6        unassigned      YES manual administratively down down
 
FastEthernet0/7        unassigned      YES manual administratively down down
 
FastEthernet0/8        unassigned      YES manual administratively down down
 
FastEthernet0/9        unassigned      YES manual administratively down down
 
FastEthernet0/10       unassigned      YES manual administratively down down
 
FastEthernet0/11       unassigned      YES manual administratively down down
 
FastEthernet0/12       unassigned      YES manual administratively down down
 
FastEthernet0/13       unassigned      YES manual administratively down down
 
FastEthernet0/14       unassigned      YES manual administratively down down
 
FastEthernet0/15       unassigned      YES manual administratively down down
 
FastEthernet0/16       unassigned      YES manual administratively down down
 
FastEthernet0/17       unassigned      YES manual administratively down down
 
FastEthernet0/18       unassigned      YES manual administratively down down
 
FastEthernet0/19       unassigned      YES manual administratively down down
 
FastEthernet0/20       unassigned      YES manual administratively down down
 
FastEthernet0/21       unassigned      YES manual administratively down down
 
FastEthernet0/22       unassigned      YES manual administratively down down
 
FastEthernet0/23       unassigned      YES manual administratively down down
 
FastEthernet0/24       unassigned      YES manual administratively down down
 
Vlan1                  unassigned      YES manual administratively down down
Switch#

• If an SVI exists for VLAN 999, remove it:

Switch(config)#interface vlan 999
Switch(config-if)#no ip address 
Switch(config-if)#shutdown 
Switch(config-if)#exit
Switch(config)#

Step 6: Verify and Test Configuration

Verify VLAN Assignment

Check VLAN 999 and assigned ports:

Switch#show vlan brief 

VLAN Name                             Status    Ports
---- -------------------------------- --------- -------------------------------
1    default                          active    Fa0/1, Fa0/2
999  Blackhole_VLAN                   active    Fa0/3, Fa0/4, Fa0/5, Fa0/6
                                                Fa0/7, Fa0/8, Fa0/9, Fa0/10
                                                Fa0/11, Fa0/12, Fa0/13, Fa0/14
                                                Fa0/15, Fa0/16, Fa0/17, Fa0/18
                                                Fa0/19, Fa0/20, Fa0/21, Fa0/22
                                                Fa0/23, Fa0/24
1002 fddi-default                     active    
1003 token-ring-default               active    
1004 fddinet-default                  active    
1005 trnet-default                    active    
Switch#

Test Port Behavior

1. Plug a PC into one of the blackholed ports (Fa0/10).

2. Assign a static IP to the PC (e.g., 192.168.1.10).

3. Try pinging other network devices – it should fail.

Step 7: Summary

• Blackhole VLANs secure unused ports by isolating them.

• Assigning unused ports to VLAN 999 ensures no traffic passes.

• Shutting down ports adds extra protection.

• No Layer 3 routing prevents communication in the blackhole VLAN.

Keywords

Blackhole VLAN, VLAN security, unused ports, Cisco switch, VLAN 999, network isolation, access ports, unauthorized access, Layer 2 security, switch configuration, port shutdown, BPDU Guard, spanning tree, VLAN assignment, port security, network protection, CLI commands, switchport mode access, show vlan brief, VLAN best practices, سیسکو