Welcome back.
In this section, we're going to look at VLANs or virtual local area networks.
We're going to virtualize our infrastructure.
Virtualization is a big topic today with companies such as VMware virtualizing servers.
But VLANs have been around for many years.
And in a similar way, we're going to be virtualizing our switches where one physical switch is virtually
multiple switches.
This is not full virtualization.
We're just virtualizing the local area networks on that specific switch.
So I want to give you an overview of VLANs and how they operate.
We need to talk about trunking protocols like ED or one Q and Iocl or Interswitch link.
I want to explain virtual trunking protocol or HTTP, which allows us to create VLANs on a single switch
and have that VLAN information propagated to other switches in the topology.
VoIP can be a very useful protocol but can be extremely dangerous and has caused a lot of problems for
Cisco engineers over the years and these days a lot of us will just turn it off and never use it because
of its inherent dangers.
Now, an incorrectly designed network or poorly designed network has multiple issues in a simple topology
as an example.
We have a switch with a hub.
This is a single broadcast domain.
So if this host a started broadcasting, that broadcast would be received by everyone.
Now that may not be a problem, but if the NIC starts jabbering, in other words, sending our broadcast
off to broadcast off the broadcast, it can flood through your entire network and cause a lot of issues.
As every device in the network needs to process that broadcast.
This issue exponentially increases as the number of hosts on the network increases.
More and more hosts are sending broadcasts.
More and more hosts are affected by those broadcasts, and thus broadcasts should be contained or limited
as far as possible.
This is an example of a poorly designed network.
If the central switch went down, it would affect all devices and the topology.
No host would be able to communicate with each other because all communication needs to go via the single
device, which is now a single point of failure.
Broadcasts once again will flood throughout the network.
The broadcast is received on all links and will consume the bandwidth on every single link in this topology.
Once again, every single device has to process that broadcast and its CPU will be interrupted by the
broadcast.
Continuous broadcasts will slow down the entire network.
Because of the way Mac address tables work traffic going to a unicast address where the Mac address
is not learnt by the switches will also be flooded throughout the topology.
Multi costs are treated in the same way as brought costs by most layer two switches.
So multi costs will be flooded throughout the network and affect all devices.
A poorly designed network may be disorganized and poorly documented and lack easily identified traffic
flows which make support, maintenance and problem resolution very time consuming and very difficult.
You also have the issue of security.
If this host on the left hand side is in marketing and the host on the right hand side is in the accounts
department, the person in marketing has access to that machine across the network because security
might not be implemented properly.
It becomes very difficult to manage a poorly designed network.
So what is a virtual lan or v lan?
A v lan is essentially a single broadcast domain or logical subnet or logical network.
You could say it's a group of hosts with a common set of requirements attached to the same broadcast
domain.
Regardless of where they are physically located, you're able to group multiple devices together logically
rather than physically.
So it is possible to span a subnet or VLAN across multiple switches, even though that's not recommended
today.
You can design a VLAN structure that allows you to group together stations or hosts that are segmented
logically by functions, project teams and other types of applications once again without regard to
physical location.
So some of the advantages of VLANs include segmentation where you segment or separate users based on
function.
For instance, the sales department will go into specific VLAN and the accountancy department will go
into different VLAN.
It's very flexible.
Without changing physical cabling, you can move a user from one VLAN to another.
It also provides security because users are in separate VLANs and therefore have to traverse a layer
three device like a router to get from one VLAN to another.
On the router you can implement access lists to control which users have access to various VLANs.
We'll be talking a lot about access lists later in the course, but for now understand that it gives
you the ability to enhance security by separating users.
These days, VLANs also have other advantages, specifically when implementing voice over IP.
You can put your IP phones into a separate VLAN to your workstations and therefore provide a better
quality of service to the IP phones.
So implementing VLANs has many advantages in modern networks today.
Something that I find that always confuses people is the difference between a physical topology and
a logical topology.
You need to change your paradigm and no longer think about the physical topology of the network, but
rather envision what the logical topology looks like.
The logical topology will be very different to the physical topology.
As soon as VLANs are implemented.
So he has an example of what a physical topology may look like.
You have four physical machines connected to a single physical switch on ports 010203 and zero four.
So that's the physical topology.
However, logically we can put interfaces into different VLANs.
So all you need to do is go onto the interface and I'll show you the commands in a moment and you put
that interface into a specific VLAN.
Let's say for argument's sake, the red VLAN now VLANs on switches are configured with numbers, but
often when we discuss VLANs we talk about colors to try and differentiate between the VLANs and make
it easier to understand.
So assume for the moment that PCI and PCI DX have been put into the red VLAN by typing commands on the
switch ports, PCB and PCC have been put into the green VLAN.
Please note that the hosts are oblivious to what's happened.
You as the administrator have just gone onto the switch and changed the VLAN that the port belongs to.
By default, all ports belong to VLAN one on Cisco switches, but by using a single command you can
move that port to a separate VLAN.
So once again the physical topology looks as follows.
But you've just got to imagine that these pieces are in separate VLANs.
However, when looking at the logical topology, things are dramatically different.
PC A and PCD are in the red VLAN on our switch.
PCC and PCB are on the green VLAN.
Logically, there are two separate switches or two separate LANs.
Here we have virtualized our LAN infrastructure and created two separate local area networks.
These networks cannot communicate with each other from a layer two point of view.
VLANs are implemented at layer two and the only way to move from one VLAN to another is to go via a
layer three device such as a router.
Remember please, a VLAN is a separate logical subnet or separate broadcast domain.
If a center broadcast, that broadcast would only be received by DH.
If C Center broadcasts, that broadcast would only be received by B, which is very different with all
the devices on the same VLAN or same physical switch.
Once again, ports can be put into a VLAN using different mechanisms.
For the moment, just assume that you as the administrator statically put the port into the relevant
VLAN.
So going back to our physical view of the topology, in this topology, we're not going to use 48 bit
MAC addresses because I want to simplify what's going on.
So just assume that these numbers A, B, C and D are the MAC addresses of these devices.
When A sends a broadcast, that broadcast will be forwarded to the switch with a source address of a
and the destination will contain ifs.
In other words, broadcast.
When that frame hits the switch, the switch will make a note of which VLAN that port belongs to, so
that frame is internally tagged with the red VLAN.
Please note the PC is oblivious to what's going on.
The PC just sees this link as standard Ethernet and doesn't understand the concept of VLANs.
I'm going to digress just for a second.
The architecture of switches vary.
Cisco have documents like this one explaining the architecture of a 6500 switch.
So for example, looking at the different chassis and different line codes and different supervisors,
this document will explain how the architecture is set up.
The detail of this is totally out of the scope of the course, but it's just to try and explain a little
bit about what happens behind the scenes.
One of the things that they explain in this document is the day in the life of a packet going through
a 6500.
And in this example, they've got centralised forwarding.
So they'll explain how a packet will arrive on an interface and based on different application, specific
integrated circuits or A6, how that packet will flow from the ingress port to an egress port going
via the data bus on the back plain of the switch.
You can learn more about the actual flow of the packet through the switch by going and looking at documents
like this.
All I want you to realize is that the architecture of different switches work differently.
And if you want to look at the internals of a switch, they are really good documents on Cisco's website
explaining how packets flow through a switch.
Well, this course we're going to explain it as follows.
When the frame arrives on this port, it's internally tagged with a red VLAN.
That frame is then copied to all other ports on the switch.
However, that broadcast will not be forwarded out of this port because the port is in a different VLAN
to the original frame.
The frame will also not be forwarded out of this port zero three because the frame is in a different
VLAN to the port.
However, on this port the frame will be forwarded out because the VLAN number or color is the same.
Please note only the original frame is sent out of the port.
No internal tagging leaves the switch.
The PCs once again are oblivious to any tagging or changing of frames, so the frame leaves the switch
and arrives at PCD in its original form.
Source addresses a destination.
Address is a broadcast.
So physically we have one switch here.
But logically, PCA can only send traffic to PCD, not to PCB or PCC.
They are on a separate VLAN or separate logical switch.
If I try to send a unicorn to sea.
So the source address is a in the frame and the destination address is C, which is this PC on the green
VLAN.
That frame would be sent to the switch as a standard Ethernet frame and we were assuming here that A
is somehow learnt the MAC address of C, so he is sending a frame directly to C.
Normally he wouldn't even be able to learn that Mac address.
So in this example, the person on a could be up to no good.
The frame arrives at the switch and the switch tags the frame internally with the red VLAN, that frame
is copied to all ports on the switch.
Now once again, that depends on the switch architecture.
So let's just assume for the moment that that's what's going to happen on this specific switch.
Now, the central ASC checks the Mac address table and sees that C can be found on Port zero three.
So the central A6 sends a flush message to the other ports to remove the copies of the frame.
So the frame is only available on port zero three.
However, just before sending out the frame, the port VLAN colours checked against the frame.
The frame is a red VLAN frame because it arrived on a red port.
But this is a green VLAN interface, so the frame is not transmitted and is dropped so the frame never
gets to PCC.
Therefore A is not able to access the green VLAN.
Logically, A is separated from C and from a layer two point of view there is no connection between
the red VLAN and the green VLAN.
As mentioned previously, the only way to get from one VLAN to another is to traverse a layer three
device such as a router and as there is no router.
In this example, the traffic is totally separated.
He has a slightly more complicated example.
A is still in the red VLAN but is connected to switch one.
Is in the red van.
But is in this case connected to.
Switch to.
Sees in the green VLAN connected to switch two and B is in the green VLAN connected to switch one.
A special type of link is required between the two switches so that they can communicate VLAN information
between them and that is known as a trunk port.
This interface will run a trunking protocol so that VLAN information can be transmitted from one switch
to another.
The two trunking protocols that are used are Eesl or Interswitch link and ed or one q.
Now, Eesl was a Cisco proprietary protocol and tends not to be used today.
ED one Q The industry standard is the protocol of choice for communicating VLAN information between
switches across trunking ports.
Now once again, it's important to remember what the physical topology looks like, which is as follows
and then the logical topology which looks like this PCA is connected to switch one.
PCC is connected to switch two, but they are in the red VLAN.
PCB is connected to switch one and PCB is connected to switch two, but they are on the green VLAN,
so there's logical separation between the devices across the two switches.
Physically, please remember there are only two switches in this topology, but logically we are creating
four switches with the red VLAN separated from the green VLAN and the switches are linked using a trunking
interface.
So trunking once again allows multiple VLANs to traverse a single physical link.
The two protocols are ed or one Q the industry standard which tends to be used today and eesl, which
was Cisco's proprietary method, which tends not to be used in today's environments.
Cisco IP phones, for example, do not support Iocl and a lot of new switches do not provide support
for Eesl.
So in this course, we're going to concentrate on 82.1 key and 82.1.
Q Frame is different to a standard Ethernet frame.
The standard Ethernet frame would look something like this.
You have a destination field, a source field, a length or ether type field.
You have the data and then you have the frame check sequence, an attitude or one.
Q Frame has a four by tag inserted into the header between the source address field and the either type
or length field.
Because the frame is being altered, the frame check sequence is re computed and replaced in the modified
frame.
The tag consists of two main parts the tag protocol identifier, which is set to 0x8100 to identify
this as an I triple e, a 2 to 1 tag frame and thus allows switches and devices to distinguish and editor
of one Q frame from untagged frames.
This is 16 bits in length or two bytes.
The remaining two bytes or 16 bits is split as follows.
Three bits represent the priority or priority code point.
Which is a three bit field used to prioritize certain traffic types over others.
This is used very heavily in quality of service where for instance, a decimal value of five is used
to represent voice.
The canonical format identifier or CFI was used in the old days for compatibility between Ethernet and
token ring networks.
It's very unlikely that you're going to use that today.
And the important piece is the VLAN identifier, which is a 12 bit field specifying the VLAN to which
this frame belongs.
A value of zero would mean that this frame does not belong to any VLAN.
It's because of this field that switches are able to communicate the VLAN number to each other.
It is 12 bits and size, which allows for 4096 VLANs to be created in an 80201 queue environment.
You can work that out as follows to.
To the power.
Of 12 equals 4096.
So in theory, 4096, VLANs could be configured on an 802 to 1 Q switch.
Switches, however, do not necessarily support that number of VLANs.