Switching Architectures: VLANs
Enterprise Network 101 Workshop
Virtual LANs (VLANs)
Virtual LANs (VLANs)
• Allow us to split switches into separate (virtual) switches
• Only members of a VLAN can see that VLAN’s traffic
– Inter-VLAN traffic must go through a router
Virtual LANs (VLANs)
• Allow us to split switches into separate (virtual) switches
• Only members of a VLAN can see that VLAN’s traffic
– Inter-VLAN traffic must go through a router
• Allow us to reuse router interfaces to carry traffic for separate
subnets
– Using sub-interfaces in Cisco routers
– Using IRB interfaces in Juniper routers
Virtual LANs (VLANs)
• Allow us to split switches into separate (virtual) switches
• Only members of a VLAN can see that VLAN’s traffic
– Inter-VLAN traffic must go through a router
• Allow us to reuse router interfaces to carry traffic for separate
subnets
– Using sub-interfaces in Cisco routers
– Using IRB interfaces in Juniper routers
• VLANs are also useful in servers especially with virtualization
– Virtual Machines (VMs) for different networks (public vs private or student vs admin) can exist on the same virtualization host
Local VLANs
• Two or more VLANs within a single switch
• The switch behaves as several virtual switches, sending traffic
only within VLAN members
• Access ports, where end nodes are connected, are configured
as members of a VLAN
• By default, all ports of a switch are members of VLAN 1 or default
VLAN (VLAN ID = 1)
• Newly created VLANs must have a VLAN ID other than 1
– Then add ports by moving them out of VLAN 1 into our new VLAN
Local VLANs
VLANs across switches
• Two switches can exchange traffic from one or more VLANs
• Inter-switch links are configured as trunks, carrying frames from
all or a subset of a switch’s VLANs
• Each frame carries a tag that identifies which VLAN it belongs to.
802.1Q
• The IEEE standard that defines how ethernet frames should be
tagged when moving across switch trunks
• This means that switches from different vendors are able to
exchange VLAN traffic.
802.1Q tagged frame
VLANs across switches
Tagged vs. Untagged
• Frames sent and received on access ports are not tagged
• You only need to tag frames in switch-to-switch links (trunks),
when transporting multiple VLANs
• However, a trunk can transport both tagged and untagged frames
– As long as the two switches agree on how to handle untagged frames
– Only one VLAN can be untagged ("native") on a given link
– Usually best avoided, but there are some cases where this is useful
Routing Inter-VLAN traffic
Traffic between VLANs must now go through a router.
Routing Inter-VLAN traffic (2)
VLANs increase complexity
• You can no longer “just replace” a switch
– Now you have VLAN configuration to maintain
– Field technicians need more skills�
• You have to make sure that all the switch-to-switch trunks are
configured to carry frames of all the necessary VLANs
– Need to keep in mind when adding/removing VLANs
Good reasons to use VLANs
1. You want multiple subnets in a building, and carry them over a
single fibre to your core router
2. You want to segment your network into multiple subnets, without
buying more switches
– Separate broadcast domains for wired, wireless, phones, device
management etc.
3. Separate control traffic from user traffic
– Restrict who can access your switch management address
Bad reasons to use VLANs
1. Because you can, and you feel cool 😉�
2. Because they will completely secure your hosts (or so you think)�
3. Because they allow you to extend the same IP network over
multiple separate buildings
– This is actually very common, but a bad idea
Do not build “VLAN spaghetti”
• VLAN “spaghetti” means extending a VLAN to multiple buildings
across trunk ports�
• Bad idea because:
– Broadcast traffic is carried across all trunks from one end of the network to another
– Broadcast storm can spread across the extent of the VLAN and affect all VLANs!
– Maintenance and troubleshooting nightmare
Cisco IOS VLAN configuration
Cisco IOS mis-features
Juniper configuration
Questions?