Blackhole VLAN
Nerd Cafe
A Blackhole VLAN is a security measure used in network environments to isolate unused switch ports and prevent unauthorized access or malicious attacks. This VLAN ensures that no traffic from those ports reaches the rest of the network.
Step 1: Understanding Blackhole VLAN
What is a Blackhole VLAN?
A VLAN (Virtual LAN) used to isolate unused switch ports.
Prevents unauthorized devices from connecting and accessing network resources.
Configured on access ports to drop all traffic.
No Layer 3 (IP) interface is assigned to this VLAN.
Step 2: Practical Scenario
Company Network Setup:
A company has a Layer 2 switch with several unused ports.
Some employees try to plug in personal devices into those ports.
The network administrator wants to ensure that any unauthorized connection is blocked using a Blackhole VLAN.
Step 3: Lab Configuration on Cisco Switch
Step 3.1: Create the Blackhole VLAN
Connect to the switch via CLI (Command Line Interface).
Enter privileged EXEC mode:
Switch>enable
Switch#Enter global configuration mode:
Switch#configure terminal
Switch(config)#Create a VLAN (e.g., VLAN 999 as Blackhole VLAN):
Switch(config)#vlan 999
Switch(config-vlan)#name Blackhole_VLANStep 4: Assign Unused Ports to Blackhole VLAN
Identify unused switch ports (e.g., FastEthernet 0/3 to 0/24).
Assign these ports to VLAN 999:
Switch(config)#interface range fastEthernet 0/3-24
Switch(config-if-range)#switchport mode access
Switch(config-if-range)#switchport access vlan 999
Switch(config-if-range)#shutdown This ensures that no traffic from these ports can access the network.
Shutting down the ports adds an extra layer of security.
Step 5: Ensure VLAN 999 is Not Routed
Verify VLAN 999 does not have an SVI (Switched Virtual Interface):
Switch#show ip interface brief
Interface IP-Address OK? Method Status Protocol
FastEthernet0/1 unassigned YES manual up up
FastEthernet0/2 unassigned YES manual up up
FastEthernet0/3 unassigned YES manual administratively down down
FastEthernet0/4 unassigned YES manual administratively down down
FastEthernet0/5 unassigned YES manual administratively down down
FastEthernet0/6 unassigned YES manual administratively down down
FastEthernet0/7 unassigned YES manual administratively down down
FastEthernet0/8 unassigned YES manual administratively down down
FastEthernet0/9 unassigned YES manual administratively down down
FastEthernet0/10 unassigned YES manual administratively down down
FastEthernet0/11 unassigned YES manual administratively down down
FastEthernet0/12 unassigned YES manual administratively down down
FastEthernet0/13 unassigned YES manual administratively down down
FastEthernet0/14 unassigned YES manual administratively down down
FastEthernet0/15 unassigned YES manual administratively down down
FastEthernet0/16 unassigned YES manual administratively down down
FastEthernet0/17 unassigned YES manual administratively down down
FastEthernet0/18 unassigned YES manual administratively down down
FastEthernet0/19 unassigned YES manual administratively down down
FastEthernet0/20 unassigned YES manual administratively down down
FastEthernet0/21 unassigned YES manual administratively down down
FastEthernet0/22 unassigned YES manual administratively down down
FastEthernet0/23 unassigned YES manual administratively down down
FastEthernet0/24 unassigned YES manual administratively down down
Vlan1 unassigned YES manual administratively down down
Switch#If an SVI exists for VLAN 999, remove it:
Switch(config)#interface vlan 999
Switch(config-if)#no ip address
Switch(config-if)#shutdown
Switch(config-if)#exit
Switch(config)#Step 6: Verify and Test Configuration
Verify VLAN Assignment
Check VLAN 999 and assigned ports:
Switch#show vlan brief
VLAN Name Status Ports
---- -------------------------------- --------- -------------------------------
1 default active Fa0/1, Fa0/2
999 Blackhole_VLAN active Fa0/3, Fa0/4, Fa0/5, Fa0/6
Fa0/7, Fa0/8, Fa0/9, Fa0/10
Fa0/11, Fa0/12, Fa0/13, Fa0/14
Fa0/15, Fa0/16, Fa0/17, Fa0/18
Fa0/19, Fa0/20, Fa0/21, Fa0/22
Fa0/23, Fa0/24
1002 fddi-default active
1003 token-ring-default active
1004 fddinet-default active
1005 trnet-default active
Switch#Test Port Behavior
Plug a PC into one of the blackholed ports (Fa0/10).
Assign a static IP to the PC (e.g.,
192.168.1.10).Try pinging other network devices – it should fail.
Step 7: Summary
Blackhole VLANs secure unused ports by isolating them.
Assigning unused ports to VLAN 999 ensures no traffic passes.
Shutting down ports adds extra protection.
No Layer 3 routing prevents communication in the blackhole VLAN.
Keywords
Blackhole VLAN, VLAN security, unused ports, Cisco switch, VLAN 999, network isolation, access ports, unauthorized access, Layer 2 security, switch configuration, port shutdown, BPDU Guard, spanning tree, VLAN assignment, port security, network protection, CLI commands, switchport mode access, show vlan brief, VLAN best practices, سیسکو
Last updated