Professional Documents
Culture Documents
VLAN introduction
Default vlan 1
vlan 10
Default vlan 1
VLAN introduction
Without VLANs
10.1.0.0/16
With VLANs
10.2.0.0/16 10.2.0.0/16
10.3.0.0/16
10.3.0.0/16
VLANs are created to provide segmentation services traditionally provided by physical routers in LAN configurations. VLANs address scalability, security, and network management.
3
Layer 2 Broadcasts
What happens when 10.1.0.10 sends an ARP Request for 10.1.0.30?
Layer 2 Broadcasts
Switch floods it out all ports. All hosts receive broadcast, even those on a different subnet. Layer 2 broadcast should be isolated to only that network. Note: If the switch supports VLANs, by default all ports belong to the same VLAN and it floods it out all ports that belong to the same VLAN as the incoming port (coming).
5
Even though hosts are connected to the same switch (or even hub),
devices on different subnets must communicate via a router. Remember a switch is a layer 2 device, it forwards by examining Destination MAC addresses, not IP addresses.
7
Fa 0/0 10.1.0.1/16
Fa 0/1 10.2.0.1/16
ARP Request
A VLAN is a broadcast domain created by one or more switches. VLANs are assigned on the switch and correspond with the host IP
address. Each switch port can be assigned to a different VLAN.
ARP Request
Ports assigned to the same VLAN share the same broadcast domain. Ports in different VLANs do not share the same broadcast domain.
10
VLAN Overview
For computers to communicate on the same VLAN:
Each must have an IP address and a subnet mask that is consistent for that VLAN. The switch has to be configured with the VLAN Each port in the VLAN must be assigned to the VLAN. A switch port with a singular VLAN configured on it is called an access port. Remember, just because two computers are physically connected to the same switch does not mean that they can communicate.
Devices on two separate networks and subnets must communicate via a router (Layer 3), whether or not VLANs are used.
11
Benefits of a VLAN
The primary benefits of using VLANs are:
Security - Groups that have sensitive data are separated from the rest of the network. Cost reduction - Cost savings result from less need for expensive network upgrades and more efficient use of existing bandwidth and uplinks. Higher performance - Dividing flat Layer 2 networks into multiple logical workgroups (broadcast domains) reduces unnecessary traffic on the network. Broadcast storm mitigation - Dividing a network into VLANs reduces the number of devices that may participate in a broadcast storm. Improved IT staff efficiency - VLANs make it easier to manage the network. When you provision a new switch, all the policies and procedures already configured for the particular VLAN are implemented when the ports are assigned. Simpler project or application management - Having separate functions makes working with a specialized application easier, for example, an e-learning development platform for faculty.
12
2 VLAN ID Ranges
Identified by a VLAN ID between 1 and 1005. IDs 1002 through 1005 are reserved for Token Ring and FDDI VLANs. IDs 1 and 1002 to 1005 are automatically created and cannot be removed. Configurations are stored within a VLAN database file, called vlan.dat.
The vlan.dat file is located in the flash memory.
The VLAN trunking protocol (VTP), can only learn normal range VLANs. Extended Range VLANs Enable service providers to extend their infrastructure to a greater number of customers. Identified by a VLAN ID between 1006 and 4094. Support fewer VLAN features. Are saved in the running configuration file. VTP does not learn extended range VLANs.
13
A data VLAN is referred to as a user VLAN. Default VLAN All switch ports become a member of the default VLAN after the initial boot up of the switch. The default VLAN for Cisco switches is VLAN 1. VLAN 1 cannot be renamed and deleted. Layer 2 control traffic, such as CDP and spanning tree protocol traffic, will always be associated with VLAN 1 - this cannot be changed. It is a security best practice to change the default VLAN to a VLAN other than VLAN 1. VLAN trunks support the transmission of traffic from more than one VLAN.
15
16
The purpose of the native VLAN is to allow frames not tagged with a VID to traverse the trunk link.
An 802.1Q native VLAN is defined as the following: VLAN that a port is associated with when not in trunking operational mode
VLAN that is associated with untagged frames that are received on a switch port VLAN to which Layer 2 frames are forwarded if received untagged on an 802.1Q trunk port
Compare this to ISL, in which no frame may be transported on the trunk link without encapsulation, and any unencapsulated frames received on a trunk port are immediately dropped.
17
IP Multicast Traffic IP multicast traffic is sent from a particular source address to a multicast group that is identified by a single IP and MAC destination-group address pair. Examples of applications that generate this type of traffic are Cisco IP/TV broadcasts. Multicast traffic can produce a large amount of data across the network. VLANs should be configured to ensure multicast traffic only goes to those user devices that use the service provided. Routers must be configured to ensure that multicast traffic is forwarded to the network areas where it is requested. Normal Data Traffic Normal data traffic is related to file creation and storage, print services, e-mail database access, and other shared network applications that are common to business uses. Data traffic should be associated with a data VLAN (other than VLAN 1), and Scavenger Class Traffic The Scavenger class is intended to provide less-than best-effort services to certain applications. Applications assigned to this class have little or no contribution to the organizational objectives of the enterprise and are typically entertainment oriented in nature. These include peer-to-peer media-sharing applications (KaZaa, Morpheus, Groekster, Napster, iMesh, and so on), gaming applications (Doom, Quake, Unreal Tournament, and so on), and any entertainment video applications.
18
VLAN operation
19
Static VLANS
Default VLAN 1
Switch(config)#interface fastethernet 0/9 Switch(config-if)#switchport access vlan 10
20
VLAN operation
Port 1 VLAN 10 Port 4 VLAN 20 Port 9 VLAN 10 Port 12 VLAN 20
VLANs are assigned on the switch port. In order for a host to be a part of that VLAN, it must be assigned an IP address that belongs to the proper subnet. Remember: VLAN = Subnet
21
VLAN operation
23
24
25
percent of the traffic contained within a VLAN. The remaining 20 percent crosses the router to the enterprise servers and to the Internet and WAN. This is known as the 80/20 rule. Note: With todays traffic patterns, this rule is becoming obsolete. The 20/80 rule applies to many of todays networks, with 20% of the traffic within a VLAN, and 80% outside the VLAN.
26
28
VLAN Trunking/Tagging
VLAN Tagging is used when a link needs to carry traffic for more than one
VLAN. Trunk link: As packets are received by the switch from any attached endstation device, a unique packet identifier is added within each header. This header information designates the VLAN membership of each packet.
29
VLAN Trunking/Tagging
VLAN Trunking/Tagging
No VLAN Tagging
VLAN Tagging
31
VLAN Trunking/Tagging
There are two major methods of frame tagging, Cisco proprietary Inter
Switch Link (ISL) and IEEE 802.1Q. ISL used to be the most common, but is now being replaced by 802.1Q frame tagging. Cisco recommends using 802.1Q. VLAN Tagging and Trunking will be discussed in the next chapter.
32
Configuring VLANs
Default vlan 1
vlan 10
Default vlan 1
33
34
Creating VLANs
Create the VLAN: (This step is not required and will be discussed
later.) Switch#vlan database Switch(vlan)#vlan vlan_number Switch(vlan)#exit
35
Creating VLANs
Default vlan 1
vlan 10
Default vlan 1
access Denotes this port as an access port and not a trunk link (later)
36
Creating VLANs
Default vlan 1
vlan 300
Default vlan 1
Switch(config)#interface fastethernet 0/9 Switch(config-if)#switchport access vlan 300 Switch(config-if)#switchport mode access
37
vlan 2
Switch(config)#interface fastethernet 0/5 Switch(config-if)#switchport access vlan 2 Switch(config-if)#switchport mode access Switch(config-if)#exit Switch(config)#interface fastethernet 0/6 Switch(config-if)#switchport access vlan 2 Switch(config-if)#switchport mode access Switch(config-if)#exit Switch(config)#interface fastethernet 0/7 Switch(config-if)#switchport access vlan 2 Switch(config-if)#switchport mode access
38
vlan 3
Switch(config)#interface range fastethernet 0/8 - 12 Switch(config-if)#switchport access vlan 3 Switch(config-if)#switchport mode access Switch(config-if)#exit
This command does not work on all 2900 switches, such as the 2900
Series XL. This format of this command may vary somewhat on various 2900 switches. It does work on the 2950.
39
Creating VLANs
Default vlan 1
vlan 300
Default vlan 1
SydneySwitch(config)#interface fastethernet 0/1 SydneySwitch(config-if)#switchport mode access SydneySwitch(config-if)#exit Note: The switchport mode access command should be configured on all ports that the network administrator does not want to become a trunk port. This will be discussed in more in the next chapter, section on DTP.
40
Creating VLANs
This link will become a trunking link unless one of the ports is configured with as an access link, I.e. switchport mode access
vlan 1 default
vlan 2
vlan 3
42
vlan 1 default
vlan 2
vlan 3
43
Deleting VLANs
This command will reset the interface to VLAN 1. VLAN 1 cannot be removed from the switch.
44
46
Fa 0/0 10.1.0.1/16
Fa 0/1 10.2.0.1/16
Host C:\>telnet 10.1.0.1 username:cisco password:class Switch>show vlan Switch>ping 10.2.0.20 Switch>telnet 10.1.0.1 Switch>exit
47
VLAN information is kept in the vlan.dat file. The file is not erased when erasing the startup-config. To remove all VLAN information, use the command above and reload
the switch.
48