Ch.

8 – VLANs (Virtual LANs)

.
Overview

• We will not cover all of the slides in this presentation, as we have

covered much of this in previous presentations.

• Define VLANs
• List the benefits of VLANs
• Explain how VLANs are used to create broadcast domains
• Explain how routers are used for communication between VLANs
• List the common VLAN types
• Define ISL and 802.1Q
• Explain the concept of geographic VLANs
• Configure static VLANs on 29xx series Catalyst switches
• Verify and save VLAN configurations
• Delete VLANs from a switch configuration
.
VLAN introduction

• VLANs provide segmentation based on broadcast domains.

• VLANs logically segment switched networks based on the functions,
project teams, or applications of the organization regardless of the
physical location or connections to the network.
• All workstations and servers used by a particular workgroup share the
same VLAN, regardless of the physical connection or location.
.
VLAN introduction

• VLANs are created to provide segmentation services traditionally

provided by physical routers in LAN configurations.
• VLANs address scalability, security, and network management.
Routers in VLAN topologies provide broadcast filtering, security, and
traffic flow management.
• Switches may not bridge any traffic between VLANs, as this would
violate the integrity of the VLAN broadcast domain.
• Traffic should only be routed between VLANs.
.
Broadcast domains with VLANs and routers

• A VLAN is a broadcast domain created by one or more switches.

• The network design above creates three separate broadcast
domains.
Broadcast domains with VLANs and routers
10.1.0.0/16

10.2.0.0/16
1) Without
VLANs
10.3.0.0/16

• 1) Without VLANs, each group is on a One link per VLAN or a single VLAN
different IP network and on a different Trunk (later) 10.1.0.0/16
switch.
2) With
• 2) Using VLANs. Switch is configured
VLANs
with the ports on the appropriate
VLAN. Still, each group on a different 10.2.0.0/16
IP network; however, They are all on
the same switch.
• What are the broadcast domains in 10.3.0.0/16
each?
.
VLAN operation

• Each switch port can be assigned to a different VLAN.

• Ports assigned to the same VLAN share broadcasts.
• Ports that do not belong to that VLAN do not share these broadcasts.
.
VLAN operation

• Static membership VLANs are called port-based and port-centric

membership VLANs.
• As a device enters the network, it automatically assumes the VLAN
membership of the port to which it is attached.
• “The default VLAN for every port in the switch is the management
VLAN. The management VLAN is always VLAN 1 and may not be
deleted.”
– This statement does not give the whole story. We will examine
Management, Default and other VLANs at the end.
• All other ports on the switch may be reassigned to alternate VLANs.
• More on VLAN 1 later.
. VLAN
operation Switch 1
172.30.1.21
172.30.2.12
255.255.255.0
255.255.255.0
VLAN 1
VLAN 2

172.30.2.10 172.30.1.23
255.255.255.0 255.255.255.0
1 2 3 4 5 6 . Port VLAN 2 VLAN 1
1 2 1 2 2 1 . VLAN

Two VLANs
Ÿ Two Subnets
Important notes on VLANs:
1. VLANs are assigned on the switch port. There is no “VLAN” assignment done on
the host (usually).
2. In order for a host to be a part of that VLAN, it must be assigned an IP address
that belongs to the proper subnet.
Remember: VLAN = Subnet
3. Assigning a host to the correct VLAN is a 2-step process:
1. Connect the host to the correct port on the switch.
2. Assign to the host the correct IP address depending on the VLAN
memebership
.
VLAN operation

• Dynamic membership VLANs are created through network

management software. (Not as common as static VLANs)
• CiscoWorks 2000 or CiscoWorks for Switched Internetworks is
used to create Dynamic VLANs.
• Dynamic VLANs allow for membership based on the MAC address of
the device connected to the switch port.
• As a device enters the network, it queries a database within the switch
for a VLAN membership.
Benefits of VLANs

If a hub is connected to VLAN port on

a switch, all devices on that hub must
belong to the same VLAN.

• The key benefit of VLANs is that they permit the network administrator
to organize the LAN logically instead of physically.
• This means that an administrator is able to do all of the following:
– Easily move workstations on the LAN.
– Easily add workstations to the LAN.
– Easily change the LAN configuration.
– Easily control network traffic.
– Improve security.
 Without VLANs – No Broadcast Control

ARP Request

172.30.1.21
Switch 1
172.30.2.12
255.255.255.0
255.255.255.0

172.30.2.10 172.30.1.23
255.255.255.0 255.255.255.0
No VLANs
Ÿ Same as a single VLAN
Ÿ Two Subnets

• Without VLANs, the ARP Request would be seen by all hosts.

• Again, consuming unnecessary network bandwidth and host processing
cycles.
With VLANs – Broadcast Control
Switch Port: VLAN ID
ARP Request

172.30.1.21
Switch 1
172.30.2.12
255.255.255.0
255.255.255.0
VLAN 1
VLAN 2

172.30.2.10 172.30.1.23
255.255.255.0 255.255.255.0
VLAN 2 VLAN 1 1 2 3 4 5 6 . Port
1 2 1 2 2 1 . VLAN

Two VLANs
Ÿ Two Subnets
VLAN Types
.
VLAN Tagging

• VLAN Tagging is used when a link needs to carry traffic for more than
one VLAN.
– Trunk link: As packets are received by the switch from any attached
end-station device, a unique packet identifier is added within each
header.
• This header information designates the VLAN membership of each
packet.
• The packet is then forwarded to the appropriate switches or routers based
on the VLAN identifier and MAC address.
• Upon reaching the destination node (Switch) the VLAN ID is removed from
the packet by the adjacent switch and forwarded to the attached device.
• Packet tagging provides a mechanism for controlling the flow of broadcasts
and applications while not interfering with the network and applications.
.
VLAN Tagging

No VLAN Tagging

VLAN Tagging

• VLAN Tagging is used when a single link needs to carry

traffic for more than one VLAN.
.
VLAN Tagging

802.10

• There are two major methods of frame tagging, Cisco proprietary Inter-
Switch Link (ISL) and IEEE 802.1Q.
• ISL used to be the most common, but is now being replaced by 802.1Q
frame tagging.
• Cisco recommends using 802.1Q.
• VLAN Tagging and Trunking will be discussed in the next chapter.
.
Two Types of VLANs

• End-to-End or Campus-wide VLANs

• Geographic or Local VLANs
.
End-to-End or Campus-wide VLANs
.
Geographic or Local VLANs
.
End-to-End or Campus-wide VLANs

• End-to-End or Campus-wide VLANs

– Same VLAN/Subnet no matter what the location is on the network
– Trunking at the Core
– Usually not recommended by Cisco or other Vendors
– Adds complexity to network administration
– Does not resolve Layer 2 Spanning Tree issues
.
End-to-End or Campus-wide VLANs

When to use End-to-End?

• Since the core layer router is being used to route between subnets (VLANs),
the rule is:
– The network is engineered to have 80 percent of the traffic contained
within a VLAN.
– The remaining 20 percent crosses the router to the enterprise servers and
to the Internet and WAN.
– Note: This is known as the 80/20 rule. With today’s traffic patterns,
this rule is becoming obsolete.
Geographic or Local VLANs

• As many corporate networks have moved to centralize their resources,

end-to-end VLANs have become more difficult to maintain.
• Users are required to use many different resources, many of which are
no longer in their VLAN.
• Because of this shift in placement and usage of resources, VLANs are
now more frequently being created around geographic boundaries
rather than commonality boundaries.
.
Geographic or Local VLANs

• This geographic location can be as large as an entire building or as

small as a single switch inside a wiring closet.
• In a VLAN structure, it is typical to find the new 20/80 rule in
effect. 80 percent of the traffic is remote to the user and 20
percent of the traffic is local to the user.
• Although this topology means that the user must cross a Layer 3
device in order to reach 80 percent of the resources, this design allows
the network to provide for a deterministic, consistent method of
accessing resources.
.
Configuring static VLANs

• The following guidelines must be followed when configuring VLANs on

Cisco 29xx switches:
– The maximum number of VLANs is switch dependent.
• 29xx switches commonly allow 4,095 VLANs
– VLAN 1 is one of the factory-default VLANs.
– VLAN 1 is the default Ethernet VLAN.
– Cisco Discovery Protocol (CDP) and VLAN Trunking Protocol
(VTP) advertisements are sent on VLAN 1.
– The Catalyst 29xx IP address is in the VLAN 1 broadcast domain
by default.
– “The switch must be in VTP server mode to create, add, or delete
VLANs.” (This is not true. Switch could be in VTP Transparent
mode. VTP will be discussed in a moment.)
.
Creating VLANs

• Assigning access ports (non-trunk ports) to a specific VLAN

Switch(config)#interface fastethernet 0/9
Switch(config-if)#switchport access vlan vlan_number

• Create the VLAN: Switch#vlan database

Switch(vlan)#vlan vlan_number
Switch(vlan)#exit
.
Creating VLANs

Default vlan Default

vlan 1 10 vlan 1
• Assign ports to the VLAN
Switch(config)#interface fastethernet 0/9
Switch(config-if)#switchport access vlan 10

• access – Denotes this port as an access port and not a trunk link (later)
.
Creating VLANs

Default vlan Default

vlan 1 300 vlan 1
.
Configuring Ranges of VLANs

vlan 2

SydneySwitch(config)#interface fastethernet 0/5

SydneySwitch(config-if)#switchport access vlan 2
SydneySwitch(config-if)#exit
SydneySwitch(config)#interface fastethernet 0/6
SydneySwitch(config-if)#switchport access vlan 2
SydneySwitch(config-if)#exit
SydneySwitch(config)#interface fastethernet 0/7
SydneySwitch(config-if)#switchport access vlan 2
.
Configuring Ranges of VLANs

vlan 3

SydneySwitch(config)#interface range fastethernet 0/8,

fastethernet 0/12
SydneySwitch(config-if)#switchport access vlan 3
SydneySwitch(config-if)#exit

This command does not work on all 2900 switches, such as the 2900
Series XL. It does work on the 2950.
.
Creating VLANs

Default vlan Default

vlan 1 300 vlan 1
SydneySwitch(config)#interface fastethernet 0/1
SydneySwitch(config-if)#switchport mode access
SydneySwitch(config-if)#exit

Note: The switchport mode access command should be configured

on all ports that the network administrator does not want to become a
trunk port.
• This will be discussed in more in the next chapter, section on DTP.
.
Creating VLANs

This link will become a trunking link unless one of the

Default: dynamic desirable ports is configured with as an access link, I.e.
switchport mode access

• By default, all ports are configured as switchport mode dynamic

desirable, which means that if the port is connected to another switch with
an port configured with the same default mode (or desirable or auto), this link
will become a trunking link. (See my article on DTP on my web site for more
information.)
• When the switchport access vlan command is used, the switchport
mode access command is not necessary since the switchport access
vlan command configures the interface as an “access” port (non-trunk port).
• This will be discussed in more in the next chapter, section on DTP.
.
Verifying VLANs – show vlan

vlan 1 vlan 2 vlan 3

default
.
Verifying VLANs – show vlan brief

vlan 1 vlan 2 vlan 3

default
.
vlan database commands

• Optional Command to add, delete, or modify VLANs.

• VLAN names, numbers, and VTP (VLAN Trunking Protocol)
information can be entered which “may” affect other switches besides
this one. (Discussed later).
• This does not assign any VLANs to an interface.

Switch#vlan database
Switch(vlan)#?
VLAN database editing buffer manipulation commands:
abort Exit mode without applying the changes
apply Apply current changes and bump revision number
exit Apply changes, bump revision number, and exit mode
no Negate a command or set its defaults
reset Abandon current changes and reread current database
show Show database information
vlan Add, delete, or modify values associated with a single VLAN
vtp Perform VTP administrative functions.
.
Deleting a Port VLAN Membership

Switch(config-if)#no switchport access vlan vlan_number

Deleting a VLAN
• Switch#vlan database
Switch(vlan)#No vlan vlan_number
Switch(vlan)#exit