VLANs can be used to f.e. group employees together. To make sure no other employee can enter the network of this department.
That’s what VLANs all about
Why We Need VLANS
What are VLANs?
A broadcast domain is defined by -> how far can a broadcast go until it stopped?
VLANs change that. When we implement VLAN green and VLAN red, we now have two broadcast domains.
And that works over different switches as well.
the definition of a trunk port is: A trunk port carries more than one VLAN.
So if we send a ping message across switches and we inspect the trunk ports on those switches we see the ping message go through with all the header informations like source mac address, source ip address, destination mac address and so on AND now we see a header information with the VLAN. This is the standard [802.1Q].
Why we use VLANs
We use VLANs mostly cause of two reasons:
- How scalable is your network?
VLAN = broadcast domain = ip subnet - Security
How to achieve that the communication from green to red works?
This is where routing comes in.
Set up the uplink port of the router as a trunk port. So every tagged frame can reach the router and the router can route the traffic to the VLAN where it belongs.
We configure interfaces on that router like Gi0/0.10 and Gi0/0.20 for the VLANs we need. These are called sub interfaces. They respond to the frames tagged with that exact VLAN. So we give the interface Gi0/0.10 the ip address 10.0.1.1 and the Gi0/0.20 the ip address 10.0.2.1 and so we can route the traffic. And that is called a ROAS (router on a stick).
Creating and Naming VLANS
When we create VLANs we create what is a called a switch virtual interface or SVI. This virtual interface represents the VLAN. We can even give it name like any other interface.
Using Trunks to Extend VLANS
Our /26 subnet we have to divide in two because each VLAN is an ip subnet. So we make a /27 network.
So we had our network 10.0.18.0/26 (10.0.18.0-10.0.18.63) we make our new subnets
10.0.18.0/27 and that is 10.0.18.0-10.0.18.31 and 10.0.18.32-10.0.18.63.
We assign 10.0.18.0/27 to the admin devices and we assign 10.0.18.32/27 to the patron devices.
Routing Between VLANS
There are two primary ways to route between VLANs.
Avoiding DTP and VTP
Dynamic trunking protocol
Technically called the standard on these switches when the port is set to “dynamic”.
If we compare these settings to a relationship of humans, we would have this analogy for the settings.
Auto -> both gonna stare at each other but don’t talk to each other
Desirable -> both form instantly a relationship
VLAN trunking protocol (VTP)
Attempt to save me time -> VLAN trunking protocol is NOT a trunking protocol at all (it should be caled VLAN replication protocol)!
802.1Q is a trunking protocol!
VLAN 10 created on SW1 and it replicates the VLAN 10 to the other switch.
Why disable?
- Somebody comes on a switch and remove VLANs and that gets replicated and all VLANs are gone.
- What happens more often, is when you bring an old switch from a lab environment and boom all VLANs replace the VLANs on the other switches.
3 modes -> Server (default), Client and Transparent
As a server I can create / delete VLANs and they get replicated.
As a client my switch cannot create and delete client but they get replicated to me.
As transparent you turn off the VTP!
You have the option to set a VTP domain name. If you are set up with the VTP domain name called COOKIE, and you have another switch in your network with the VTP domain name CHOCOLATE, these are considered as two domains, and will NOT replicate fromeach other.
If you don’t set the VTP domain, it is considered NULL and will take the first domain name it receives.
The Purpose of the Native VLAN
The primary purpose of the Native VLAN is to handle untagged traffic received on an 802.1Q trunk port. A lot of people use the native VLAN for management.
For security reasons you should change the native VLAN to something else then VLAN 1.
Cisco IOS Commands learned in this chapter
| Command | Description | |||||
| Switchport | Mode | Trunk | ||||
| Switchport | Trunk | Allowed | Vlan | <NUMBER> | removes all other VLANs only VLAN 10 stays | |
| Switchport | Trunk | Allowed | Vlan | Add | <NUMBER> | adds the VLAN 10 to the list of other vlans |
| Switchport | Trunk | Allowed | Vlan | Remove | <NUMBER> | removes VLAN 10 from the list of allowed vlans |
| No | Switchport | Trunk | Allowed | Vlan | <NUMBER> | removes all the “trunk allowed vlan 10” chunk |
| Switchport | Trunk | nonegotiate | not gonna talk -> turn off DTP | |||
| Switchport | Trunk | Encapsulation | Dot1q | <VLAN_ID> | Sets the encapsulation so the router knows which 802.1Q tag to look for | |
| Vtp | Mode | Server/client/transparent | Sets the VTP mode (transparentis OFF) | |||
| Vtp | Domain | COOKIE | Sets the VTP domainname | |||
| interface | Gi0/0.10 | |||||
| Ip address | 10.0.1.1 | 255.255.255.0 | Sets the ip address for the subinterface to act as the default gateway | |||