Friday, April 13, 2018

Nexus 5500 VLAN hopping with ping - Is this expected?

I have the following setup

 +-------------+ | | | HOSTA | IP Address: 5.5.5.5 +--------------> | | | | | | +------+------+ | | | | | # Reply | | sent to HOSTA | | | | |MAC: 5555.5555.5555 | |SVI: 5.5.5.1/24 | +-------------------------------+ | | VLAN 5 | + | | | Nexus 5500 | ^ | | | | VLAN 10 | | +-------------------------------+ | |SVI: 10.10.10.1/24 | |MAC: 1010.1010.1010 | | | | | #1 Ping | | ping 5.5.5.1 | | | | | | | | +------+-------+ | | | Static ARP: 5.5.5.1 5555.5555.5555 + | BLACK BOX | IP Address: 5.5.5.5 | | | | +--------------+ 

Pings from VLAN 10 are generating replies to HOSTA in VLAN 5. This doesn't seem like the greatest security concern in my naive mind but doesn't this break separation of VLANs?



No comments:

Post a Comment