Allied Telesis AT-8100 Series - Manual (Page 950)

Chapter 62: GARP VLAN Registration Protocol
950
GVRP and Network Security
GVRP should be used with caution because it can expose your network to
unauthorized access. If a network intruder were to connect to a switch port
running GVRP and transmit a bogus GVRP PDU containing VIDs of
restricted VLANs, GVRP would make the port a member of the VLANs,
giving the intruder access to restricted areas of your network.
Here are a couple of suggestions to protect against this type of network
intrusion:
 Activating GVRP only on those switch ports connected to other
GVRP devices. Do not activate GVRP on ports that are connected
to GVRP-inactive devices.
 Converting all dynamic GVRP VLANs and dynamic GVRP ports to
static assignments, and then turning off GVRP on all the switches.
This preserves the new VLAN assignments while protecting
against network intrusion.