Guest VLAN Leaking Into Management
A branch office runs a single Aruba access switch with VLAN 1 (native, untagged) for management, VLAN 10 for staff, and VLAN 50 for guest Wi-Fi. The guest SSID is bridged locally to VLAN 50. A consultant ran a scan from a guest laptop and reached the switch's management IP on VLAN 1 and the AP's management interface. The uplink to the router is a trunk allowing VLANs 1, 10, and 50. There is no firewall between VLANs; inter-VLAN routing happens on the router with a permit-any rule. Staff report the guest network 'works fine,' so nobody has changed it.
1. Explain the security failure and why 'it works fine' is not evidence of correctness.
Read the worked answer
The guest segment is not isolated; functional connectivity is masking a segmentation failure.
- VLAN 1 is the native VLAN and is untagged on the trunk. Guest traffic bridged to VLAN 50 should be tagged; if any guest-facing port or AP uplink is misconfigured as untagged/native, guest frames land in VLAN 1 and reach management.
- The router permits any-to-any between VLANs, so even correctly tagged guest traffic can route to VLAN 10 and VLAN 1 subnets.
- The AP management interface being reachable from guest confirms the guest path shares L2/L3 reachability with infrastructure.
'Works fine' only means users can reach the internet; it says nothing about lateral reachability. The correct test is an explicit reachability matrix from the guest segment, which the consultant performed and which failed.
2. List the concrete configuration changes to enforce guest isolation, in priority order.
Read the worked answer
Priority order (highest risk first):
- Remove VLAN 1 as native / stop using VLAN 1 for management. Move management to a dedicated VLAN (e.g., VLAN 99) and set the trunk native VLAN to an unused, blackholed VLAN. This closes the untagged-leak path.
- Fix the AP/guest port tagging so VLAN 50 is tagged on the trunk and guest ports are untagged-only in VLAN 50 with no access to other VLANs.
- Replace permit-any on the router with an explicit policy: guest → internet only; guest → staff/management denied; staff → guest denied by default.
- Add L2 protections on guest-facing ports: no inter-client bridging if supported, DHCP snooping/RA guard where applicable, and rate limiting.
- Verify with a post-change scan from the guest segment: management IPs, AP management, and staff subnets must be unreachable; internet must still work.