While VLANs provide logical segmentation, they weren't designed as primary security mechanisms. The common warning against relying solely on VLANs stems from several inherent vulnerabilities:

• VLAN hopping attacks (switch spoofing or double tagging)
• Misconfigured trunk ports allowing unauthorized VLAN access
• ARP poisoning across VLANs
• Native VLAN mismatches exposing traffic

From your description, you've implemented several security best practices with HP Procurve 1800-24G switches:

# Example of secure port configuration
interface 1/1/1
   switchport mode access
   switchport access vlan 10
   switchport trunk native vlan 999
   switchport trunk allowed vlan none
   spanning-tree portfast
   no cdp enable

Even with your current safeguards, consider these scenarios:

# Demonstration of potential VLAN hopping
# Attacker sends double-tagged frame:
outer_vlan = attacker_native_vlan
inner_vlan = target_vlan
if switch_forwards_based_on_outer_tag:
   frame_reaches_inner_vlan

Add these measures to strengthen your VLAN implementation:

1. Implement Private VLANs where appropriate
2. Enable DHCP snooping to prevent rogue DHCP servers
3. Configure IP Source Guard to prevent IP spoofing
4. Use VLAN ACLs (VACLs) for intra-VLAN filtering

# Example VACL configuration
vlan access-map FILTER_VLAN10 10
   match ip address 110
   action drop
vlan access-map FILTER_VLAN10 20
   action forward
vlan filter FILTER_VLAN10 vlan-list 10

Since you're using a firewall between VLANs, ensure:

• Explicit deny-all between VLANs with specific allow rules
• Logging for all inter-VLAN traffic
• Regular rulebase audits
• Stateful inspection for all permitted flows

Many network administrators believe VLANs provide adequate security through logical segmentation. While VLANs do create broadcast domains and prevent basic layer 2 communication between segments, they were never designed as security controls. The original 802.1Q standard focused on traffic management, not security enforcement.

Your HP Procurve configuration addresses common VLAN hopping vectors like:

# Example of proper switch port configuration
interface GigabitEthernet0/1
 switchport mode access
 switchport access vlan 10
 switchport nonegotiate
 spanning-tree portfast

However, several fundamental security gaps remain:

Even with ingress filtering and proper PVID configuration, advanced attacks can bypass VLAN separation:

# Example of VLAN hopping attack simulation
from scapy.all import *
packet = Ether(dst="01:00:0C:CC:CC:CC")/Dot1Q(vlan=100)/Dot1Q(vlan=200)/IP(src="10.1.1.1",dst="10.2.2.2")/ICMP()
sendp(packet, iface="eth0")

Different switch vendors handle edge cases differently. For example:

• Some switches may process frames with multiple tags despite ingress filtering
• Management interfaces sometimes bridge VLANs unintentionally
• Firmware bugs can bypass VLAN restrictions

While your inter-VLAN firewall adds protection, consider:

# Example firewall rule that still leaves exposure
iptables -A FORWARD -i vlan10 -o vlan20 -p tcp --dport 80 -j ACCEPT

This allows any compromised host in VLAN10 to attack web services in VLAN20.

Combine VLANs with additional controls:

# Example MACsec configuration for additional protection
configure terminal
interface GigabitEthernet0/1
 mka policy MKA-POLICY
 mka pre-shared-key key-name VLAN10 key-string S3cr3tK3y
 mka enable

Other essential measures include:

• Implementing 802.1X port authentication
• Enabling DHCP snooping
• Configuring IP Source Guard
• Using private VLANs where appropriate

In zero-trust environments, VLANs should only be one component of your segmentation strategy. Consider software-defined segmentation that doesn't rely solely on 802.1Q tags for security boundaries.