VLAN Query Protocol VQP
Prior to the establishment of the IEEE 802.1x standard, Cisco developed a technology called the VLAN Management Policy Server (VMPS). VMPS works with a flat file policy database that is sent to VMPS serv switches by TFTP. VMPS client switches then communicate with the VMPS server using VQP. VMPS allow switch to dynamically assign VLANs to users based on their MAC address or user identity (if used with th User Registration Tool [URT]).
Unfortunately, VQP is a UDP-based protocol that does not support any form of authentication. This mak its use in security-sensitive environments inadvisable. An attacker who is able to spoof VQP (not hard since it runs UDP) could then try to prevent network logins or might join a VLAN unauthorized.
VQP and VMPS are rarely used for MAC-based VLAN assignment because of the management burden of maintaining the MAC address to VLAN mapping table. The URT component is also not frequently used, especially since a standards-based method of effectively doing the same thing (802.1x) is now available
Continue reading here: Creative VLAN Hopping Attacks
Was this article helpful?