On which network layers is a perimeter built in practice, and what is the difference between separating on Layer 2 physically and virtually?
In principle a perimeter is possible on every OSI layer, but in practice it is almost always isolation on Layer 2 plus restriction on Layer 3. Physical L2 separation uses different switches and can only be broken physically; virtual separation (VLANs) can be broken by configuration.
* Physical separation can only be broken by a cable; a VLAN boundary is a setting that a mistake or an attacker can change. *
| Physical L2 separation | Virtual L2 separation (VLAN) | |
|---|---|---|
| How | Each broadcast domain is served by its own switches | One switch is split into virtual Layer 2 networks (supported from the lower mid-range up) |
| How the perimeter can break | Only physically: someone plugs in a cable that bridges the two | Through configuration: an accidental misconfiguration, or a successful attack on the switch's management interface |
The trade-off is the same as with isolation in general: the virtual variant is cheaper and more flexible, but the boundary is now a setting rather than a missing cable, so anyone who can change the setting can remove the boundary.
Go deeper:
VLAN — Wikipedia — how one switch is split into separate broadcast domains.
TechKnowSurge — CCNA LANs 11-4: VLAN Hopping — how a misconfigured trunk lets traffic jump between VLANs.- NetworkLessons — VLAN Hopping — switch spoofing and double tagging, with the configuration that prevents them.