Incident

New intern's PC is on the production-server VLAN by mistake

Network EngineeringDifficulty · Easy

Retry in progress

You have 1 previous attempt for this scenario. Submitting again will create a new attempt and show a comparison against your most recent response.

VLAN MisconfigDifficulty · easyHigh asset

[POSSIBLE INCIDENT] Marketing intern PC seeing prod servers in ARP

From: Senior Security Analyst <soc-l2@acme-corp.com>
To: netops@acme-corp.com
Date: 2026-04-19 09:55 UTC

On a routine onboarding check, a new marketing intern reported that their laptop is "showing weird hostnames" — they ran arp on their first day and saw production server names (db-prod-01, web-prod-02) on their local subnet. Their PC is plugged into ACCESS-SW-12 port Gi1/0/24 in the marketing area. Marketing should be on VLAN 200 (office), not VLAN 100 (prod-servers). The switch port log says the wrong access-VLAN was applied on Apr 18 18:12 UTC, so the port has been bridged into the prod-servers segment for roughly 16 hours by the time we noticed — please bound the exposure window before doing anything destructive. Please confirm and remediate. Treat as access-control / segmentation violation while you investigate, not just a typo. Critically, before you remediate: did the intern's workstation actually reach any production resource (db-prod-01 / web-prod-02 SSH / SMB / HTTP), or is this only L2 visibility? We need that answered from logs, not assumed. A plea from the on-call: do not "fix" this by converting the marketing access ports to trunk, do not delete VLAN 100 to "make the leak go away", and do not clear the switch's MAC address-table before evidence is preserved. Move the port, scope the exposure, then harden. — SOC L2

Evidence

ACCESS-SW-12 port + VLAN view

ACCESS-SW-12#show interfaces Gi1/0/24 switchport
Name: Gi1/0/24
Switchport: Enabled
Administrative Mode: static access
Operational Mode: static access
Access Mode VLAN: 100 (prod-servers)        <-- wrong, should be 200 (office)
Trunking Native Mode VLAN: 1 (default)
Voice VLAN: none

ACCESS-SW-12#show vlan brief | include 100|200
100  prod-servers      active    Gi1/0/24
200  office            active    Gi1/0/1, Gi1/0/2, ..., Gi1/0/23, Gi1/0/25

# Switch port log (last 24h)
Apr 18 18:12:03 ACCESS-SW-12 %CONFIG: configure terminal — user: cli-noc-jr
Apr 18 18:12:18  interface Gi1/0/24
Apr 18 18:12:31    switchport access vlan 100   <-- assignment moment
Apr 18 18:12:35  end
Apr 18 18:12:38 ACCESS-SW-12 %CONFIG: write memory — user: cli-noc-jr

# show mac address-table on the affected port
ACCESS-SW-12#show mac address-table interface Gi1/0/24
   100   bcd1.7f00.55aa   DYNAMIC   Gi1/0/24       <-- intern PC, learned in prod VLAN

# Intern's PC ARP (sample)
Internet  10.0.100.5    0  bcd1.7f00.0102  ARPA  Vlan100
Internet  10.0.100.18   0  bcd1.7f00.018a  ARPA  Vlan100
Internet  10.0.100.1    0  bcd1.7f00.5500  ARPA  Vlan100   <-- prod VLAN gateway

# DHCP server (10.50.0.10) lease record for the intern's MAC
Apr 18 18:13:02  OFFER   bcd1.7f00.55aa  10.0.100.84  scope=PROD-SERVERS-100
Apr 18 18:13:02  ACK     bcd1.7f00.55aa  10.0.100.84  lease=8h, renewed twice since
                  -- the intern's PC pulled an IP from the prod-VLAN scope (L3 reachability into prod is real, not just L2 visibility)

# NAC / 802.1X session on Gi1/0/24
ACCESS-SW-12#show authentication sessions interface Gi1/0/24 details
   Interface              Gi1/0/24
   IIF-ID                 0x1ABCDEF
   MAC Address            bcd1.7f00.55aa
   IPv4 Address           10.0.100.84
   User-Name              <none>            <-- no 802.1X supplicant on intern's first-day laptop
   Status                 Authorized        <-- via MAB fallback (port profile MARKETING-PORT permits MAB)
   Method                 mab
                   -- 802.1X is not enforced on this port; MAB authorized the MAC into whatever
                      access VLAN the port was statically configured for (which was prod-100).

# Edge firewall hit log (10.50.30.5 INTERN-ACCESS rule, last 16h)
Apr 18 18:14:22  10.0.100.84:51022 -> 10.0.100.10 (db-prod-01):22   ALLOW   syn,ack,push  3 sessions
Apr 18 18:14:51  10.0.100.84:51188 -> 10.0.100.18 (web-prod-02):443  ALLOW  tls handshake completed, 220 KB transferred
Apr 18 19:02:09  10.0.100.84:51904 -> 10.0.100.10:445 (smb)         DENY   ACL "PROD-INTRA-ONLY" hit count: 4
                   -- the intern's host did reach db-prod-01 (SSH banner only, no auth attempt logged) and web-prod-02 (TLS established)
                      so this is no longer "only an L2 misconfig"; treat scope as confirmed exposure of two prod hosts.

# Controlled distractors (rule out wider faults so root cause stays at the access-VLAN assignment)
ACCESS-SW-12#show interface Gi1/0/24 | include line protocol|optic|errors|CRC
   Gi1/0/24 is up, line protocol is up   0 input errors  0 CRC  optic Rx -3.2 dBm (within spec)

DHCP server (10.50.0.10) status: healthy, all other VLAN scopes leasing normally
ACCESS-SW-12#show interface trunk | include Po1
   Po1   on   802.1q   trunking   1   <-- uplink to DIST-A clean; no native vlan mismatch
No DIST-* / CORE-* config change in the last 7 days.

# Edge firewall view of the marketing office VLAN (200)
   No drops, no anomalies on the legitimate office segment in the same window.

Affected asset

Name: ACCESS-SW-12 Gi1/0/24 + intern PC
Type: Marketing intern access port currently bridged into prod VLAN 100; intended VLAN 200 (office); reaches prod-VLAN gateway 10.0.100.1; downstream visibility into prod-servers segment (db-prod-01, web-prod-02); MAB-authorized via NAC profile MARKETING-PORT, no 802.1X supplicant on the laptop
Owner: Network Operations · Marketing wing
Level: High