Vlan

A Local Area Network (LAN)was originally defined as a network of computers located within the same area

Local Area Networks are defined as a single broadcast domain. This means that if a user broadcasts information on his/her LAN, the broadcast will be received by every other user on the LAN.

Broadcasts are prevented from leaving a LAN by using a router. The disadvantage of this method is routers usually take more time to process incoming data compared to a bridge or a switch

AVLANis a logical group of network devices that appears to be on the same LAN

Configured as if they are attached to the same physical connection even if they are located on a number of different LAN segments.

Logically segment LAN into different broadcast domains.

VLANs can logically segment users into different subnets (broadcast domains)

Broadcast frames are only switched on the same VLAN ID.

This is a logical segmentation and not a physical one, workstations do not have to be physically located together. Users on different floors of the same building, or even in different buildings can now belong to the same LAN.

By using switches, we

can assign computer

on different floors to

VLAN1, VLAN2, and

Now, logically, a

department is spread

across 3 floors even

though they are

physically located on

different floors

Static membership VLANs are calledport-basedand port-centric membership VLANs.

This is the most common method of assigning ports to VLANs.

As a device enters the network, it automatically assumes the VLAN membership of the port to which it is attached.

There is adefault VLAN , on Cisco switches that is VLAN 1.

Dynamic membershipVLANs are created throughnetworkmanagement software

Dynamic VLANs allow for membership based on the MAC address of the device connected to the switch port.

As a device enters the network, it queries a database within the switch for a VLAN membership

Access portsare used when:

Only a single device is connected to the port

Multiple devices (hub) are connected to the port, all belonging to the same VLAN

Another switch is connected to this interface, but this link is only carrying a single VLAN (non-trunk link).

Trunk portsare used when:

Another switch is connected to this interface, and this link is carrying multiple VLANs(trunk link).

Switch(config-if)switchport mode [access|trunk]

An access port means that the port (interface) can only belong to a single VLAN.

In a switched network,a trunk is a point-to-point link that supports several VLANs.

The purpose of a trunk is to conserve ports when a link between two devices that implement VLANs is created .

Two techniques

Frame Filtering --examines particular information about each frame (MAC address or layer 3 protocol type)

Frame Tagging --places a unique identifier in the header of each frame as it is forwarded throughout the network backbone.

Users can be logically group via softwarebased on:

port number

MAC address

Ip subnet

protocol being used

Membership by Port

Membership by MAC Address

Membership by IP Subnet Address

Membership by Port

Advantage :

no reconfiguration needed

Disadvantage :

VLAN membership must be assigned initially.

performance degradation as members of different VLANs coexist on a single switch port

Membership by Port

Advantage:

Good for application-based VLAN strategy

User can move workstations

eliminate the need for frame tagging

VLAN frame tagging was specifically developed for switched communications.

Frame tagging places aunique identifierin the header of each frame as it is forwarded throughout the network backbone.

The identifier is understood and examined by each switch before any broadcasts or transmissions are made to other switches, routers, or end stations.

When the frame exits the network backbone, the switch removes the identifier before the frame is transmitted to the target end station.

The two most common tagging schemes for Ethernet segments are

ISL (Inter-Switch Link)

802.1Q An IEEE standard

An Ethernet frame is encapsulated with a header that transports VLAN IDs.

The ISL encapsulation is added by the switch before sending across the trunk.

The switch removes the ISL encapsulation before sending it out a non trunk link.

It addsoverheadto the frame as a26-byte headercontaining a10-bit VLAN ID .

In addition, a4-byte cyclic redundancy check (CRC)is appended to the end of each frame.

This CRC is in addition to any frame checking that the Ethernet frame requires.

Significantly less overhead than the ISL.

802.1Q inserts only an additional 4 bytes into the Ethernet frame.

The802.1Q tagis inserted by the switch before sending across the trunk.

The switch removes the 802.1Q tag before sending it out a non trunk link.

Trunking protocols were developed to effectively manage the transfer of frames from different VLANs on a single physical link.

The trunking protocols establish agreement for the distribution of frames to the associated ports at both ends of the trunk.

VLAN tagging information is added by the switch before it is sent across the trunk and removed by the switch before it is sent down a non-trunk link

If SwitchA can only be a 802.1.Q trunk and SwitchB can be either ISL or 802.1Q trunk, configure SwitchB to be 802.1Q.

On switches that support both 802.1Q and ISL, theswitchport trunk encapsulationcommand must be done BEFORE theswitchport mode trunkcommand.

Configuring VLANs under Linux is a process similar to configuring regular Ethernet interfaces. The main difference is you first must attach each VLAN to a physical device. This is accomplished with the vconfig utility. If the trunk device itself is configured, it is treated as native. For example, these commands define VLANs2-4 on device eth0:

vconfig add eth0 2

vconfig add eth0 3

vconfig add eth0 4

Before you begin configuration, make sure the IP address of the switch falls within the new management subnet. The IP configuration is associated with a virtual interface. This is normally VLAN1.

interface VLAN1 ip address 10.0.0.2 255.255.255.224

interface FastEthernet 0/1

switchport trunk encapsulation dot1q

switchport mode trunk

interface FastEthernet0/2 switchport access vlan 2

Once your changes are complete, you can see which ports are in which VLAN by using the show vlan command.

Performance

Formation of Virtual Workgroups

Simplified Administration

Reduced Cost

Security

David Passmore, John Freeman, ``The Virtual LAN Technology Report,'

Paul Frieden, VLANS on LINUX

TPID - defined value of 8100 in hex. When a frame has the EtherType equal to 8100, this frame carries the tag IEEE 802.1Q / 802.1P.

TCI- Tag Control Information field including user priority, Canonical format indicator and VLAN ID.

User Priority - Defines user priority, giving eight (2^3) priority levels. IEEE 802.1P defines the operation for these 3 user priority bits.

CFI - Canonical Format Indicator is always set to zero for Ethernet switches. CFI is used for compatibility reason between Ethernet type network and Token Ring type network. If a frame received at an Ethernet port has a CFI set to 1, then that frame should not be forwarded as it is to an untagged port.

VID - VLAN ID is the identification of the VLAN, which is basically used by the standard 802.1Q. It has 12 bits and allow the identification of 4096 (2^12) VLANs. Of the 4096 possible VIDs, a VID of 0 is used to identify priority frames and value 4095 (FFF) is reserved, so the maximum possible VLAN configurations are 4,094.

Education

Vlan