Chapter 4

Version 1

Virtual LANs

Introduction

By default, switches forward broadcasts, this means that all segments connected to a switch are in one broadcast domain. Virtual LANs or VLANs are used to control broadcasts as well as simplify network management:

VLANs increase the number of broadcast domains while decreasing their size. Network adds, moves and changes are achieved by configuring ports into the appropriate VLAN. VLANs can enhance network security. A group of users needing high security can be placed into a VLAN so that no users outside of the VLAN can communicate with them.

VLAN Memberships

VLANs are created by an administrator, who assigns switch ports to each VLAN, which is called a static VLAN. A dynamic VLAN uses a database, created by an administrator, with all the MAC addresses of all the host devices. This allows a host to plug into a switch and be dynamically assigned to a VLAN based on their MAC address.

Static VLANs

Static VLANs are the usual way of creating VLANs and the most secure. The switch port you assign to a VLAN always maintains the association until an administrator changes the port assignment. This type of setup is easy to configure, monitor and control. When you plug a host into a switch port with static VLANs, the host must have the correct IP configuration or else it will not be able to access the network.

Dynamic VLANs

A dynamic VLAN determines a host’s VLAN assignment automatically using intelligent management software. When you connect a host to an unassigned port, the VLAN management database can look up the MAC address, assign and configure the switch port to the correct VLAN. This setup requires more work initially, but can be beneficial when a user moves, because the switch will assign them to the correct VLAN automatically. Administrators use the VLAN Management Policy Server (VMPS) to create a database of MAC addresses that are mapped to VLANs.

Identifying VLANs

Switches must be able to keep track of all the different types of frames as they are switched throughout the network, as well as understand what to do with the frames depending on the MAC address. Frames are handled differently depending on the type of link they are traversing. There are two types of links: Access links - only part of 1 VLAN and it’s referred to as the native VLAN of the port. Any device attached to an access link is unaware of VLAN membership. Switches remove any VLAN info from the frame before it’s sent to an access-link device. Access-link devices can’t communicate outside the VLAN unless the packet is routed. Trunk links - carries multiple VLANs (between 1 and 1005) across a point-to-point link between 2 switches or a switch and server. If the link between 2 switches is not trunked, then only VLAN1 info will be switched across the link. All VLANs are configured on a trunked link.

Frame Tagging

When multiple VLANs are spanning multiple switches in the network, there needs to be a way for each switch to keep track of all the users and frames as they travel the switch fabric. This is where frame tagging comes in. This frame identification method uniquely assigns a user-defined ID to each frame, sometimes referred to as a “VLAN ID” or “color”.

Each switch that the frame reaches must first identify the VLAN ID from the frame tag, then it looks at the info in the filter table to determine what to do with the frame. If the frame reaches a switch that has another trunked link, the frame will be forwarded out the trunk-link port. When the frame reaches an access link, the VLAN identifier is removed, so the destination device can receive the frame without understanding their VLAN identification.

VLAN Identification Methods

There are two trunking methods that allow switches to identify which frames belong to which VLANs – inter-switch VLAN communication: Inter-Switch Link (ISL) – proprietary to Cisco switches and used for Fast Ethernet and Gigabit Ethernet links only. IEEE 802.1Q – standard method for frame tagging, if you’re trunking between a Cisco switch and another brand of switch, you have to use 802.1Q for the trunk link to work. You must designate each 802.1Q port to be associated with a specific VLAN ID. The ports that populate the same trunk create a group known as a native VLAN and each port gets tagged with an ID number that reflects its native VLAN - default is VLAN 1.

ISL Protocol

ISL is a Cisco proprietary protocol that tags VLAN info onto an Ethernet frame. This tagging info allows VLANs to be multiplexed over a trunk link through an external encapsulation method (ISL), which allows the switch to identify the VLAN membership of a frame. ISL functions at layer 2 by encapsulating a data frame with a 26 byte header, 4 byte frame check sequence (FCS) and a cyclic redundancy check (CRC). Remember, the ISL header is proprietary and can only be read by devices running ISL.

ISL VLAN info is only added to a frame if it is forwarded out of a trunk link. Otherwise, the info is stripped when the frame is forwarded out of a access link.

VTP

VLAN trunking protocol (VTP) was also created by Cisco, but it isn’t proprietary. VTP manages all configured VLANs to maintain consistency throughout the network. VTP allows an admin to add, delete and rename VLANs and then propagates this info to all other switches in the VTP domain.

VLAN benefits: Consistent VLAN configuration across all switches. Allows VLANs to be trunked over mixed networks (Ethernet, FDDI). Accurate tracking and monitoring of VLANs. Dynamic reporting of added VLANs to all switches in the VTP domain. Plug-and-play VLAN adding.

VTP Operation

Before you can get VTP to manage your VLANs, you have to create a VTP server. All VTP servers that need to share VLAN info must use the same domain name and a switch can only be in one domain at a time.

VTP info is sent between switches over a trunk port. Switches advertise VTP management domain info, configuration revision number and all known VLANs with any specific parameters.

VTP Operation Modes

There are 3 different modes of operation within a VTP domain: Server – this is the default for all Catalyst switches. You need at least 1 server in your VTP domain to propagate VLAN info. The switch must be in server mode to create, delete or rename VLANs and those changes will be advertised to the entire VTP domain. Client – in client mode, switches receive info from VTP servers, they send and receive updates, but can’t make any changes. The ports of a client switch can be added to a new VLAN before the VTP server notifies the client switch of the new VLAN. Transparent – switches in transparent mode don’t participate in the VTP domain, but they’ll still forward VTP advertisements through trunk links. These switches don’t share info with other switches, because their VLAN databases are locally significant only.

VTP Pruning

VTP pruning only sends broadcasts to trunk links that need the information, which helps preserve bandwidth. By default, VTP pruning is disabled. When you enable VTP pruning, it will be set for the entire domain with VLANs 2-1005 being eligible. VLAN 1 can never be pruned because it is an administrative VLAN.

Here’s an example of how it works: If switch A doesn’t have any ports configured for VLAN 5 and a broadcast is sent throughout VLAN 5, the broadcast wouldn’t traverse the trunk link to switch A.

Routing Between VLANs

Host can communicate within their own VLAN by default, but in order for separate VLANs to communicate, a layer 3 device is needed.

There are two different ways to configure a router with VLANs. One way is to have a router configured with a VLAN per (sub)interface, so there is an individual VLAN association to the router. The other way is to have all VLANs use one router interface, which Cisco calls “router on a stick”.

Router With Individual VLAN Associations

Router-on-a-stick

Exam Essentials

Know when VLANs are used and why Understand the term “frame tagging” Understand the ISL VLAN identification method Understand the 802.1Q VLAN identification method Understand VTP operation Know the VTP operation mode

END Chapter 4Virtual LANs