Before we dive into the basics of VLAN, I would ask all of you to pause this video, click on the icon in the lower left corner that says Networking Consultant, visit our Facebook page, and give us a like. Then come back to the video and click on the King icon in the lower right corner to subscribe to our official YouTube channel. We continuously add new series, currently focusing on the CCNA course, and then we plan to start the CCNA Security, Network+, PMP, ITIL, Prince2 video tutorial courses and publish these wonderful series on our channel.
So, today we will discuss the basics of VLAN and answer 3 questions: what is VLAN, why do we need VLAN, and how to configure it. I hope that after watching this video tutorial, you will be able to answer all three questions.
What is VLAN? VLAN stands for 'Virtual Local Area Network'. As we proceed through our lesson, we'll examine why this network is virtual, but before we get into VLAN, we need to understand how a switch works. We will revisit some of the questions we discussed in previous lessons.
First, letβs discuss what a Multiple Collision Domain is. We know that this switch with 48 ports has 48 collision domains. This means that each of these ports or devices connected to these ports can interact with another device on a different port independently, without affecting each other.
All 48 ports of this switch are part of one broadcast domain. This means that if several devices are connected to multiple ports, and one of them broadcasts, it will appear on all the ports that the other devices are connected to. This is exactly how a switch operates.
It's like people sitting in one room close together, and when one of them speaks loudly, everyone else can hear. However, this is completely inefficient β the more people appear in the room, the louder it becomes, and the attendees will stop being able to hear each other. A similar situation arises with computers β the more devices connected to one network, the louder the broadcast becomes, which doesnβt allow for effective communication.
We know that if one of these devices is connected to the network 192.168.1.0/24, all other devices are part of the same network. The switch also needs to be connected to a network with the same IP address. However, as a Layer 2 OSI device, the switch may encounter an issue. If two devices are connected to the same network, they can easily communicate with each other's computers. Let's say there's a 'bad guy,' a hacker, working in our company, represented above. Below him is my computer. This hacker can easily infiltrate my computer because our computers are part of the same network. This is the concern.
If I belong to the administrative leadership and this new guy can access the files on my computer, that would be quite problematic. Of course, my computer has a firewall that protects against many threats, but it wouldn't be too difficult for the hacker to bypass it.
The second danger that exists for everyone who is a member of this broadcast domain is that if someone has an issue with broadcasting, that interference will affect other devices on the network. Although all 48 ports can be connected to different hosts, a failure in one host will impact the remaining 47, which we definitely do not want.
To solve this problem, we use the concept of VLAN, or Virtual Local Area Network. It operates quite simply by dividing this large 48-port switch into several smaller switches.
We know that subnets divide one large network into several smaller networks, and VLAN works in a similar way. It divides a 48-port switch, for example, into 4 switches of 12 ports each, with each being part of a newly connected network. This way, we can use 12 ports for management, 12 ports for IP telephony, and so on, effectively dividing the switch not physically but logically, virtually.
I highlighted three ports on the top switch, marked in blue, for the 'blue' network VLAN10, and assigned three orange ports for VLAN20. Therefore, any traffic from one of these blue ports will only reach other blue ports, not affecting the other ports of this switch. Similarly, traffic from the orange ports will follow the same rule, as if we were using two different physical switches. Thus, VLAN is a way to divide a switch into several switches for different networks.
I drew two switches at the top; here we have a situation where on the left switch only the blue ports are active for one network, while on the right only the orange ports are active for another network, and these switches are not connected to each other in any way.
Suppose you want to use more ports. Imagine we have 2 buildings, each with its own management team, and two orange ports on the bottom switch are used for management. Therefore, we need these ports to be connected to all the orange ports of other switches. A similar situation applies to the blue ports β all blue ports on the top switch must connect to the other ports of the same color. For this, we need to physically link these two switches in different buildings with a dedicated line, represented in the drawing as a line between two green ports. As we know, if two switches are physically connected, we create a trunk.
What is the difference between a regular switch and a VLAN switch? The difference is not significant. When you buy a new switch, all ports are configured by default to operate in VLAN mode and are part of a single network, referred to as VLAN1. This is why when we connect a device to one port, it is connected to all other ports, because all 48 ports belong to the same virtual network, VLAN1. However, if we configure the blue ports to work in network VLAN10, the orange ones in network VLAN20, and the green ones in VLAN1, we effectively create 3 different switches. Thus, using VLAN mode allows us to logically group ports under specific networks, partition broadcast traffic, and create subnets. Each port of a specific color belongs to a separate network. If the blue ports operate in network 192.168.1.0 and the orange ports also operate in network 192.168.1.0, even with the same IP address, they will not be connected to each other because they will logically belong to different switches. And as we know, different physical switches do not communicate with each other unless connected by a common link. Hence, we create different subnets for different VLANs.
I would like to draw your attention to the fact that the VLAN concept applies only to switches. Anyone familiar with encapsulation protocols such as .1Q or ISL knows that neither routers nor computers have any VLANs. When you connect your computer, for example, to one of the blue ports, you are making no changes to your computer; all changes occur only at Layer 2 of the OSI model, the switch layer. When we configure ports to work with a specific network VLAN10 or VLAN20, the switch creates a VLAN database. It 'records' in its memory that ports 1, 3, and 5 belong to VLAN10, ports 14, 15, and 18 are part of network VLAN20, while the other active ports belong to network VLAN1. Therefore, if some traffic originates from blue port 1, it only goes to ports 3 and 5 of the same VLAN10 network. The switch 'looks' into its database and sees that if traffic originates from one of the orange ports, it should go only to the orange ports of network VLAN20.
However, the computer knows nothing about these VLAN networks. When we connect two switches, a trunk is formed between the green ports. The term 'trunk' is relevant only for Cisco devices; other network device manufacturers, such as Juniper, use the term Tag port. I believe that the name Tag port is more appropriate. When traffic leaves this network, the trunk transmits it to all ports of the next switch, meaning we are connecting two 48-port switches to create one 96-port switch. At this point, when we send traffic from VLAN10, it becomes tagged, that is, it is supplied with a label indicating that it is intended only for the ports of VLAN10. The second switch, upon receiving this traffic, reads the tag and understands that this traffic is specifically for VLAN10 and must go only to the blue ports. Similarly, the 'orange' traffic for VLAN20 is tagged to indicate that it is meant for the VLAN20 ports of the second switch.
We also mentioned encapsulation, and there are two encapsulation methods. The first is .1Q, meaning that when we set up a trunk, we must ensure encapsulation. The .1Q encapsulation protocol is an open standard that describes the traffic tagging procedure. There is another protocol called ISL, Inter-Switch Link, developed by Cisco, which indicates the traffic's association with a specific VLAN. All modern switches work with the .1Q protocol, so when you receive a new switch out of the box, you don't need to use any encapsulation commands, as it is handled by the .1Q protocol by default. Therefore, after creating the trunk, traffic encapsulation happens automatically, allowing tags to be read.
Now let's proceed to configure the VLAN network. We will create a network that includes two switches and two end devices β computers PC1 and PC2, which we will connect with cables to switch #0. Let's start with the basic settings of the switch: Basic Configuration.
To do this, we will click on the switch and access the command line interface, then set the hostname by naming this switch sw1. Now, let's proceed to configure the first computer and assign it a static IP address of 192.168.1.1 with a subnet mask of 255.255.255.0. The default gateway address is not needed, as all our devices are in the same network. Next, we will do the same for the second computer, assigning it the IP address 192.168.1.2.
Now let's return to the first computer to ping the second computer. As we can see, the ping was successful because both computers are connected to the same switch and are part of the same default VLAN1 network. If we look at the switch interfaces now, we will see that all FastEthernet ports from 1 to 24 and two GigabitEthernet ports are configured to VLAN #1. However, this excessive availability is unnecessary, so we will enter the switch settings and use the command show vlan to look at the virtual network database.
Here you can see the name of the VLAN1 network and that all the switch ports belong to this network. This means that you can connect to any port, and they will all be able to 'communicate' with each other because they are part of the same network.
We will change this situation, so first we will create two virtual networks by adding VLAN10. The command format for creating a virtual network is 'vlan network number'.
As you can see, when trying to create the network, the system gave a message listing the VLAN configuration commands that need to be used for this action:
exit β apply changes and exit the settings;
name β enter a user-defined name for the VLAN;
no β cancel the command or set it to default.
This means that before entering the command to create the VLAN, you need to enter the command name, which enables the naming management mode, and then proceed to create the new network. In this case, the system provides a hint that the VLAN network number can be assigned in the range from 1 to 1005.
So now we enter the command to create the VLAN network number 20 β vlan 20, and then assign it a user-defined name that indicates what kind of network it is. In our case, we use the command name Employees, or the network for the company's employees.
Now we need to assign a specific port for this VLAN. We enter the switch's configuration mode with int f0/1, then manually set the port to access mode using the command switchport mode access and specify which port to convert to this mode β this is the port for the VLAN10 network.
We see that after this, the connection point color of PC0 and the switch, the port color, changed from green to orange. It will turn green again once the configuration changes take effect. Let's try to ping the second computer. We haven't made any changes to the network settings for the computers; they still have IP addresses 192.168.1.1 and 192.168.1.2. However, if we attempt to ping computer PC1 from computer PC0, it won't work, because these computers now belong to different networks: the first to VLAN10 and the second to native VLAN1.
Let's return to the switch interface and configure the second port. For this, I will enter the command int f0/2 and repeat the same steps for the VLAN 20 network as I did when setting up the previous virtual network.
We see that now the lower port of the switch, to which the second computer is connected, has also changed its color from green to orange β it will take a few seconds for the configuration changes to take effect and for it to turn green again. If we try to ping the second computer again, it won't work, because the computers still belong to different networks, only PC1 is now part of VLAN20 instead of VLAN1.
Thus, you have divided one physical switch into two different logical switches. You see that now the port color has changed from orange to green, indicating it is operational, but it still cannot be pinged because it belongs to a different network.
Let's make changes to our setup β we'll disconnect computer PC1 from the first switch and connect it to the second switch, while connecting the switches together with a cable.
To establish a connection between them, I will access the settings of the second switch and create VLAN10, naming it Management, which is the management network. I will then enable Access mode and specify that this mode is for VLAN10. Now, the color of the ports connecting the switches has changed from orange to green because they are both configured for VLAN10. We now need to create a trunk between both switches. Both of these ports are Fa0/2, so we need to create a trunk for the Fa0/2 port on the first switch using the command switchport mode trunk. The same must be done for the second switch, after which a trunk will form between these two ports.
Now, if I want to ping from the first computer to computer PC1, it will work because the connection between PC0 and switch #0 is VLAN10, between switch #1 and PC1 is also VLAN10, and both switches are connected by a trunk.
So, if devices are located in different VLAN networks, they are not connected to each other, but if they are in the same network, they can freely exchange traffic. Let's try to add one more device to each switch.
In the network settings of the added computer PC2, I will set the IP address to 192.168.2.1, and in the settings of PC3 β the address to 192.168.2.2. The ports to which these two PCs are connected will be labeled Fa0/3. In the settings of switch #0, we will set Access mode and specify that this port is designated for VLAN20, and we will do the same for switch #1.
If I use the command switchport access vlan 20, and VLAN20 has not yet been created, the system will return an error stating 'Access VLAN does not exist' because the switches are configured to work only with VLAN10.
Let's create VLAN20. I will use the command 'show vlan' to view the virtual network database.
You can see that the default network is VLAN1, to which ports Fa0/4 through Fa0/24 and Gig0/1, Gig0/2 are connected. The virtual network number 10, named Management, is connected to port Fa0/1, while the VLAN network number 20, with the default name VLAN0020, is connected to port Fa0/3.
In principle, the name of the network doesn't matter, as long as it is not duplicated for different networks. If I want to change the default name assigned by the system, I use the command vlan 20 and name Employees. I can change this name to something else, for example, IPphones, and if we ping the IP address 192.168.2.2, we will see that the VLAN name doesn't matter.
The last thing I want to mention is the assignment of the Management IP, which we discussed in the last lesson. For this, we use the command int vlan1 and enter the IP address 10.1.1.1 and subnet mask 255.255.255.0, and then add the command no shutdown. We assign the Management IP not to the entire switch, but only to the ports of VLAN1, meaning we assigned an IP address from which VLAN1 can be managed. If we want to manage VLAN2, we need to create the corresponding interface for VLAN2. In our case, we have blue ports VLAN10 and orange ports VLAN20, corresponding to addresses 192.168.1.0 and 192.168.2.0.
VLAN10 should have addresses located in the same range so that the corresponding devices can connect to it. A similar configuration should be made for VLAN20.
This command-line window of the switch shows the interface settings for VLAN1, that is, the native VLAN.
To configure the Management IP for VLAN10, we must create the interface int vlan 10, and then add the IP address 192.168.1.10 and subnet mask 255.255.255.0.
To configure VLAN20, we must create the interface int vlan 20, and then add the IP address 192.168.2.10 and subnet mask 255.255.255.0.
Why is this necessary? If computer PC0 and the top left port of switch #0 belong to the 192.168.1.0 network, PC2 pertains to the 192.168.2.0 network and is connected to the native VLAN1 port, which pertains to the 10.1.1.1 network, then PC0 cannot communicate with this switch via SSH protocol because they belong to different networks. Therefore, for PC0 to be able to communicate with the switch via SSH or Telnet, we must provide it with Access. This is why we need network management.
We need to be able to link PC0 with the IP address of the VLAN20 interface via SSH or Telnet and make any necessary changes through SSH. Thus, the Management IP is essential for configuring VLAN because each virtual network must have its own access management.
In today's video, we covered a lot of topics: the main switch settings, creating VLAN networks, assigning VLAN ports, assigning Management IPs for VLAN networks, and configuring trunks. Don't be confused if you didn't understand something; it's natural since VLAN is a very complex and extensive topic that we will revisit in future lessons. I assure you that with my help, you will become 'masters' of VLAN, but the purpose of this lesson was to clarify 3 questions: what VLAN networks are, why we need them, and how to configure them.
Thank you for staying with us. Do you enjoy our articles? Would you like to see more interesting materials? Support us by placing an order or recommending us to your friends. 30% discount for Habr users on a unique entry-level server designed by us for you: (options available with RAID1 and RAID10, up to 24 cores and up to 40GB DDR4).
Dell R730xd for half the price? Only with us in the Netherlands! Dell R420 β 2x E5-2430 2.2GHz 6C 128GB DDR3 2x960GB SSD 1Gbps 100TB β from $99! Read about how
Source: habr.com
