- So let's talk a little bit more about broadcast domains
and how we can manipulate them and control them on switches.
Because after all this is one of the big benefits
of switches is it gives us the ability
to control and configure something called virtual LANs.
So here we're going to talk about what are virtual LANs,
why do we need them, and how do we configure and test them.
Alright so in this particular picture right here
we have two physically distinct,
separate local area networks.
We have a local area network for Sales
and a local area network for Marketing.
They're completely separate.
They're not connected in any way.
Maybe we did that intentionally
because we have security reasons.
You know those people in Sales, you know sometimes
they get a little funny and we don't want them
sending information to those people in Marketing,
so we want to keep them completely separate and distinct.
So we look at this and we say okay this is great
but wouldn't it be better if instead of having
two separate networking devices, two bridges,
wouldn't it be great if we could just have one device?
Both departments are connected to that one device
but we're still able to keep them separated from each other.
Because right now Sales is in their own broadcast domain.
Right, because we know that bridges and switches
when they receive in a frame, if the destination address
of that frame is unknown,
the switch does not have that in its table.
Like a broadcast, like a multicast,
or like a unicast MAC address that
just has never been learned,
the switch or the bridge will flood that frame.
It'll send it out to all the other ports
other than the one where it came in.
So on the left we have a broadcast domain,
and on the right we have a broadcast domain.
Wouldn't it be nice if we could get rid of those two bridges
and replace them with just a single device
that still everybody could connect to
but could maintain our isolation and separation
of different broadcast domains?
And that's exactly what virtual LANs are.
So now we have a switch and we have configured
our virtual LANs, and we've put the ports
into those virtual LANs.
And now it separates out our broadcast domains.
So a virtual LAN that is the purpose of it.
It separates broadcast domains.
It gives you a little bit of flexibility and control.
Now you might be wondering, well why would I want to
separate out my broadcast domains?
A variety of reasons.
Number one.
Every time an actual broadcast,
an Ethernet frame with a destination MAC address of FFFFFFFF
or all ones in binary, every time an Ethernet frame
with a destination of a broadcast hits your NIC card,
your NIC card has to take that in,
send it up to the CPU of your laptop,
and your laptop has to inspect it.
Now if it's just one broadcast, not a big deal.
But as the broadcast domain gets bigger and bigger
and bigger, if I go from having four devices to 14 devices
to 400 devices all in one broadcast domain,
you're going to see a lot of broadcasts.
Broadcasts are used by a lot of legitimate protocols.
ARP uses broadcasts.
DHCP uses broadcasts.
There's a lot of things that use broadcasts.
You would be surprised at how frequently
your laptop is sending out broadcasts
without you even touching it,
without you even touching the keyboard.
So if you can imagine your CPU is getting busier and busier
and busier, processing all these broadcasts
as they're coming in.
That's going to have an effect on you.
Your websites are going to seem to load slower.
Your email's going to load slower.
Anything that has to do with networking on your laptop
is going to start grinding to a halt.
So that's one reason why we might want to take
a rather large network and partition it
into different VLANs, into different broadcast domains.
Also for security restrictions.
So from a layer 3 perspective, an IP perspective,
all the devices in one broadcast domain
are in the same subnet.
They're in the same IP network.
Well when it comes to doing security like say,
okay I want Joe to be able to get to this server over here,
but I don't want Sally to be able to get to the server.
If everybody's on the same subnet and same broadcast domain,
that's possible but it's hard.
As a matter of fact at the CCNA level,
you don't even learn how to do that.
Once you go into the CCNP level
and you're starting for your CCNP switch exam,
then you'll learn of ways to do that.
But it's difficult.
It's a lot easier if I can separate people
into different broadcast domains, different subnets,
there's a lot of other ways, a lot of easier ways,
to prevent devices from one subnet
from talking to another subnet.
But when we're all in the same subnet on the same VLAN,
that gets kind of tricky.
So from a security perspective, you might want to
break up your network into different partitions
or different VLANs.
So provides better security, controls broadcast like ARP,
and provides hierarchical subnet usage.
Not really going to expand on that one all that much.
So as far as VLANs are concerned,
and this is the way it's been for decades,
the VLAN range is from 1 to 4094.
So that's the VLANs you have available to you.
Now there are some VLANs that are called normal-range VLANs,
1 through 1001.
And usually people just stick with VLANs
in that number, in that range.
Now it's completely up to you.
You say okay, so I've decided that I want Payroll,
all of the people in Payroll to be in one IP subnet,
and I'll put them in a VLAN.
Which VLAN should it be?
It's up to you.
You could select VLAN 2 for them.
You could select VLAN 359.
Completely up to you.
It's just the main thing to remember is that
one IP subnet has to be in its own unique VLAN number,
and another IP subnet has to be in a different VLAN number.
You can't have two different subnets at Layer 3
sharing the same VLAN.
Because if you do that,
now they're seeing each other's broadcasts.
And that's exactly what we wanted to avoid.
Also just the reverse is true.
I can't have a user over here who's in one subnet,
a user over here who's in the exact same subnet,
same network, but they're in two different VLANs.
If they're in two different VLANs,
they're not sharing broadcasts.
At Layer 3, they think they're in the same broadcast domain.
They say, oh I'm in the same subnet as that guy.
I can ARP for him.
But ARP is a broadcast.
When you send out an ARP request for something
that you think is in your network,
that's making the assumption
that that broadcast can get to that guy.
But if in reality, he's in a different VLAN,
even if at Layer 3, he's in the same subnet as you.
But if he's in a different broadcast domain,
in a different VLAN, your broadcast will not reach him.
And I'm going to demonstrate that here in just a moment.
So some of the VLANs right there in the middle,
1002 through 1005, are reserved.
I don't think you're ever going to be tested on that
they're reserved for token ring necessarily,
but you should remember that those ones
there in the middle are reserved.
You cannot use them.
They're unusable.
So you should probably remember
that 1002 through 1005 are unusable.
And then the higher numbers 1006 through 4094
are extended-range VLANs.
Once again, once you get to the CCNP switch exam,
we learn more about those.
And there are some caveats and gotchas as far as
if you want to use those, there are certain other things
you have to do first.
At the CCNA level though, we don't really get into that.
Okay so how do I configure VLAN?
So remember that initially when you turn on a switch,
review question, when you turn on a switch are the ports
on the switch by default administratively down
or administratively enabled?
They are administratively enabled.
Routers, their interfaces are
administratively shut down by default.
But by default, switch ports are up
as soon as you plug something in.
Now when you get a switch,
whether it's got eight ports or whether it's got 200 ports,
the default behavior is that all those interfaces
are in VLAN 1, the default VLAN.
You should remember that.
VLAN 1 is already there.
You don't have to configure it.
It is the default VLAN and all the interfaces are in it.
Now if you say, oh okay well that's cool
because that one switch is going to be connected to Payroll.
Nobody but Payroll is going to be connected to that switch.
And everybody in Payroll is going to be in the same subnet,
so they're going to be in the same broadcast domain.
No problem then.
You don't have to create any VLANs.
You don't have to change any VLANs.
But if you do want to go on a switch
and you want to create some new VLANs,
it's a two-step process.
Step number one is just creating it and naming it,
like VLAN 2, VLAN 9, just basically telling the switch
I'm creating a new VLAN on you.
VLAN 200, VLAN 300, that's literally the command.
VLAN and the VLAN ID.
Don't even worry about the legacy way.
Nobody does that.
This is the way you're going to do it.
Config t, go into global config mode,
and then just type vlan and the number.
Like vlan 5, vlan 7.
Optionally if you want to.
This is optional.
You can provide it a name.
And this kind of helps if you're looking at
the running config and it says VLAN 2
and then underneath it it says Engineering VLAN.
And then VLAN 3, Marketing VLAN.
Now you know, oh okay, I know why these VLANs were created.
You don't have to give it a name,
but it's just kind of nice, a descriptive characteristic.
Now that's step number one.
Just because I created VLAN 5,
the switch can't read my mind.
It doesn't have telepathy.
It doesn't know which interfaces
I want to put into that broadcast domain.
So that's the second step.
Now we have to go into the interfaces, right.
Interface, Fast Ethernet, whatever.
And apply that VLAN to the interface.
And here's how we do that.
We type switchport mode access.
We saw that in the last slide, right?
In the last video?
That's saying this interface
is in one broadcast domain only.
Now if all I did was type that, it would still be in VLAN 1.
I really wouldn't have done much.
But then I typed switchport access vlan whatever.
Switchport access vlan 2
if I want it to be in that broadcast domain.
Switchport access vlan 99
if I want it to be in that broadcast domain.
So critical thing I want you to take away from this,
on switchports
the mode dictates what the interface is doing.
The main mode we've really focused on
so far is just access mode.
There are other modes as well.
When we talk about trunking in the next section,
we're going to get into that.
So but why I'm saying that is because,
if you look at the running config of a switch
and you see on a particular interface
it says switchport access vlan 20,
you can't automatically assume that that interface
is just in VLAN 20 and it's providing access to some device.
You can't assume that just from this command right here.
This command does not tell you
how this interface is operating right now.
All that command says is
if this interface ever becomes an access port,
if it's ever in that mode, then while it's an access port,
it's going to be in this VLAN right here.
But we don't know from this command what the mode is.
That's where this command is critical.
So if this interface was in some other kind of mode,
you might think oh okay well if I put it in some other mode
this right here will just vanish from the configuration,
right?
Nope.
This could be in another mode
and you would still see this in your running config.
So the point I'm trying to make to you is, step number one,
when doing any kind of troubleshooting is
identify what mode is my interface in.
Because then you can look at a running config
and you can say oh okay well these commands I can ignore
because they don't apply to the particular mode
that I'm operating in right now.
And some verification commands.
Show vlan is probably the command
you're going to use the most often.
It shows you the VLANs that you've got
and what interfaces are applied to those VLANs.
And you can also do show interface,
like show interface Fast Ethernet 0/1,
and then the keyword of switchport at the end.
Let's do some demonstrations of this.
So for this demonstration, I've created this topology here
which I'm going to be using.
So I've got switch 2.
And in my particular lab which is a real light,
I'm using INE's rack so INE's rack rentals.
So if you ever buy some tokens and you do some
rack rental time on our CCNA/CCNP racks,
that's exactly what I'm going to be using here
in this demonstration
and most of our demonstrations coming up.
So I've got a switch, but in our racks
we don't actually have any real Hosts.
There's no laptops or Pcs in the racks.
So I'm actually using Routers.
This is actually Router 1, Router 2, and Router 3.
But I'm going to pretend that they're Hosts.
I've just given them IP addresses,
and we're just going to be using them to initiate pings.
So they're not going to be doing any fancy routing stuff.
Let's just pretend that they're Hosts.
And I changed their names, their Host names,
to Host 1, Host 2, Host 3 just for demonstration purposes.
Okay.
So let's go on to Switch 2 to begin with.
And what I recommend that you might want to do is right now
if you haven't already done this,
take a screenshot of this image.
That way when I log into the devices,
you can be looking at the screenshot
while I'm showing you the command line
and you won't get confused as to which device I'm in
and port numbers and all that kind of stuff.
Okay so hopefully you had enough time
or you've paused the video and you've taken that screenshot.
So let's go over here.
So first of all, I'm going to go ahead and I am in Switch 2.
Remember user exec mode.
You can't really do anything from here,
so I want to type enable.
So the first thing I want to see is
what VLANs are in this switch.
Honestly I don't know if this switch
has just the default VLANs.
There might be some other VLANs in here
from some previous labs that I did.
So I'm just going to type show vlan.
Okay it just has the default VLAN.
So we see here VLAN 1.
There has been no name configured
so the name is just default.
And it's active.
And you can see these are all the ports
that are in that VLAN.
Now if a port, if you know there's a port on the switch
but it does not show up here,
but you know that port is actually up
and connected to something,
if it's not anywhere in this output,
that means that port is not an access port.
Only ports that are in the switchport mode access
will show up here as access ports
in the various VLANs that you've got.
If it's not here then that means it's in some other mode,
probably what we call trunking mode
that we'll talk about in another video.
So right now we have this and so if we look at that,
that means all three of these interfaces
are in the same VLAN.
Let me go ahead and bring them up.
By the way, this command I'm doing right here,
this is a useful command on switches, interface range.
This way you can group a bunch of interfaces together.
And now the configuration command I apply is going to apply
across all of them at the same time.
So I don't have to get into each interface
one at a time at a time.
So I'll just do no shutdown.
I disabled them purposefully before this lab
just to demonstrate.
Okay so I'm going to go into Host 1.
And we can see that Host 1 in his ARP table
all he knows about is himself.
Now because they are all three in the same subnet.
You can see they're all three in the 1.2.3 network.
And I'll put a circle here.
They're all three in the same VLAN which is VLAN 1.
They should be able to exchange broadcasts.
So if on PC 1 I ping PC 2,
the first thing it's going to do,
it's going to send out an ARP request.
So my first ping will probably fail.
That ARP request will be a broadcast.
So when it's broadcast, PC 2 and PC 3 will see it.
And then PC 2 will respond back to that with an ARP reply.
And then the ping should go through.
So if PC 1 can actually ping PC 2,
that will prove the broadcast works.
And actually because this is a Router,
I have the ability to turn on a debug
to actually watch the ARP go out.
And I'm going to do that.
So debug arp.
So here we go, ping 1.2.3.2.
Alright undebug all turns off the debug.
So we can see here, as soon as I did the ping,
we see IP ARP sent request.
So he sent an ARP request.
He says this is me.
This is my MAC.
And I'm looking for 1.2.3.2.
I don't know his MAC.
And because they are in the same broadcast domain,
we received an ARP response.
Received, reply.
And now we can see here the MAC address.
And then the pings were successful after that.
Now I'm also going to do the same thing.
I'm going to ping 1.2.3.3.
He's ARPing for him right now.
I turned off the debug.
And now when I do show arp,
we can see he's learned about everything in his ARP table.
So all three of these guys know about each other.
Now look what happens if I do this.
I'm going to leave these two ports in VLAN 1,
but I'm going to take this port right here
and I'm going to create a new VLAN called VLAN 2.
And I'm going to put this interface in that port.
So that's step number one, let's do that.
So the first step is to create the VLAN.
So I have to go into global configuration mode to do that.
And I just type vlan 2.
And I could give it a name if I want.
Name let's just say Engineering.
Okay.
And now I haven't done, I haven't applied the VLAN
to an interface yet.
So now when I do the show vlan command,
you can see there it is with the name.
But there are no interfaces associated with it yet.
So now what I need to do is I need to go to
interface Fast Ethernet 0/3
and apply VLAN 2 to that interface.
And that is the switchport.
We want to do switchport mode access
and then switchport access vlan 2.
That's the command that moves it from VLAN 1,
which is what it was in, now into VLAN 2.
And now if I do the show vlan command,
now we see that interface is in VLAN 2.
Okay.
Now here's an interesting question.
If we go over to Host 1,
show arp,
okay?
He thinks that 1.2.3.3 is this MAC address right here.
I can't memorize that, so I'm just going to remember
the last four characters, 6dd8.
6dd8.
So this is
6dd8.
That's him.
And Router 1 says
in his ARP table,
1.2.3.3 equals MAC 6dd8.
Make this a little bit bigger here.
Okay, but this MAC address, back when Router 1,
Host 1 ARPed, the ARP was successful
back when PC 3 was in the same VLAN, when he was in VLAN 1.
And 6dd8 was originally learned in VLAN 1.
Is it still in VLAN 1?
Well let's take a look at the MAC address table.
Show mac address-table.
And we're looking for an address ending with 6dd8.
Look at this, 6dd8 is now in VLAN 2.
In VLAN 2.
So what's going to happen if PC 1 pings,
because he already has an ARP entry, right?
He already thinks hey I don't have to ARP anymore.
I know the guy's MAC address.
Let's think about what's going to happen here.
So it's going to come in this way.
And I'm going to draw it over here because I have more room.
So the IP source will be 1.2.3.1.
The IP destination will be 1.2.3.3.
The MAC source will be whatever PC 1 is.
And the MAC destination is going to be xxxx.xxxx.6dd8.
Now when that comes into this port,
what's that switch going to do?
You might think oh well no problem.
I means he's going to look at his MAC at his table, right
and he's going to find 6dd8.
And he's going to find it's associated to port 0/3.
I mean after all that's what we see right here, right?
There it is.
Here's the problem.
Look at this.
The MAC address table does not just
store the MAC address and a port.
It also stores what VLAN it belongs to.
So this is going to be a problem for us,
because when this frame comes in, going to 6dd8,
the switch is going to say oh
it came in on a port that's in VLAN 1.
In my MAC address table I need to find 6dd8 in VLAN 1.
And he's not going to find it
because it's not in VLAN 1, it's in VLAN 2.
And so guess what, our ping is going to fail.
The switch is not going to say oh okay,
well I'm going to just allow this frame to jump
from one broadcast domain to another broadcast domain.
The switch is not going to do that.
Remember this a virtual LAN.
In a real LAN, in a real LAN, when you put an Ethernet frame
on the wire, the destination MAC address
for that frame has to be somebody on your wire.
That is the rules of Ethernet.
When you put an Ethernet frame on the wire,
it's destined for somebody on your wire.
Now if you're trying to get your packet,
if you're trying to get your data to somebody
on another wire, the destination MAC address
has to be a Router that's on your wire.
So you can get that frame to the Router who's on your wire
and then he can route it to another subnet.
But this is not going to work here
because this would be breaking the rules of Ethernet.
If this ping actually worked, that would mean that
PC 1 was putting an Ethernet frame on his wire
with a destination MAC address of something
that was not on his wire.
And it somehow magically hopped from one wire to the other,
from one LAN to the other.
But the whole reason we create virtual LANs
is to separate them.
So PC 1 should not be able to ping PC 3.
Now this is all in theory here.
Because they're on two separate broadcast domains,
even though he has the MAC address.
Let's see what happens.
Show arp.
Okay.
Ping 1.2.3.3.
Ah, there we go.
See, I'm just getting dots.
So the ping is not working even though he has a MAC entry.
It's not working because they're on
different broadcast domains.
Now watch this.
I'm going to clear out his ARP table.
Clear arp.
So now when I do show arp.
Clear arp, let's say, 1.2.3.3.
Okay.
So 1.2.3.3 is gone.
Debug arp.
Now let's ping 1.2.3.3.
Sending a request.
He's not getting any responses because these are broadcasts.
So he sent all these requests
but he didn't get any ARP reply.
Even though this guy's in the same subnet as him,
he was in a different virtual LAN.
And broadcasts from this virtual LAN,
ARP requests were not allowed to go into this virtual LAN.
Even when PC 1 knew what the MAC address of PC 3 was,
it still couldn't get over here
because the rules of Ethernet say,
when you put an Ethernet frame on the wire,
it has to be destined for somebody
in your broadcast domain, in your LAN.
In this case, they're not in the same LAN.
They're in separate virtual LANs.
One other thing I want to show you is
the output of that other command that we saw.
So we already looked at show vlan,
and you're going to use that command a lot
in your networking career.
You can also do show interface, Fast Ethernet
and then whatever it is, and the keyword of switchport.
This is a very useful command.
Number one it shows you, what is my operational mode?
Static access.
So administrative mode means, what am I configured to do?
Operational mode means, what I am actually doing?
Sometimes what you're configured to do doesn't work
because it relies on things that aren't turned on
or aren't working properly.
And so your operational mode will be different.
But right now we're the same.
But look down here.
Access Mode VLAN, VLAN 2, Engineering.
So that says, if this is operationally an access port,
which it is, if that's true, then this will be in VLAN 2.
And that concludes this video on virtual LANs.