During a security audit, a penetration tester demonstrates that they can send frames from an access port on VLAN 10 and have those frames delivered to hosts on VLAN 20 without crossing a router. The tester accomplished this by inserting two 802.1Q tags into a single frame. Which action BEST mitigates this specific attack?