What is VLANs? – A virtual LAN (VLAN) is any broadcast domain that is partitioned and isolated in a computer network at the data link layer (OSI layer 2).LAN is the abbreviation for local area network and in this context virtual refers to a physical object recreated and altered by additional logic. VLANs work by applying tags to network frames and handling these tags in networking systems – creating the appearance and functionality of network traffic that is physically on a single network but acts as if it is split between separate networks. In this way, VLANs can keep network applications separate despite being connected to the same physical network, and without requiring multiple sets of cabling and networking devices to be deployed.
What is VLANs?
I know I keep telling you this, but I’ve got to be sure you never forget it, so here I go, one last time: By default, switches break up collision domains and routers break up broadcast domains. Okay, I feel better! Now we can move on.
in contrast to the networks of yesterday that were based on collapsed backbones, today’s network design is characterized by a flatter architecture—thanks to switches. So now what? How do we break up broadcast domains in a pure switched internetwork? By creating virtual local area network (VLANs). A VLAN is a logical grouping of network users and resources connected to administratively defined ports on a switch.
When you create VLANs, you’re given the ability to create smaller broadcast domains within a layer 2 switched internetwork by assigning different ports on the switch to service different subnetworks. A VLAN is treated like its own subnet or broadcast domain, meaning that frames broadcast onto the network are only switched between the ports logically grouped within the same VLAN.
What is VLANs?
So, does this mean we no longer need routers? Maybe yes; maybe no. It really depends on what you want or what your needs are. By default, hosts in a specific VLAN cannot communicate with hosts that are members of another VLAN, so if you want inter-VLAN communication, the answer is that you still need a router.
Below Figure shows how layer 2 switched networks are typically designed—as flat networks. With this configuration, every broadcast packet transmitted is seen by every device on the network regardless of whether the device needs to receive that data or not.
By default, routers allow broadcasts to occur only within the originating network, while switches forward broadcasts to all segments. Oh, and by the way, the reason it’s called a flat network is because it’s one broadcast domain , not because the actual design is physically flat. In Figure we see Host A sending out a broadcast and all ports on all switches forwarding it—all except the port that originally received it.
What is VLANs?
Now check out Below Figure. It pictures a switched network and shows Host A sending a frame with Host D as its destination. What’s important is that, as you can see, that frame is only forwarded out the port where Host D is located. This is a huge improvement over the old hub networks, unless having one collision domain by default is what you really want. (Probably not!)
Now you already know that the largest benefit you gain by having a layer 2 switched network is that it creates individual collision domain segments for each device plugged into each port on the switch. This scenario frees us from the Ethernet density constraints, so now larger networks can be built. But often, each new advance comes with new issues. For instance, the larger the number of users and devices, the more broadcasts and packets each switch must handle.
And here’s another issue: security! This one’s real trouble because within the typical layer 2 switched internetwork, all users can see all devices by default. And you can’t stop devices from broadcasting, plus you can’t stop users from trying to respond to broadcasts. This means your security options are dismally limited to placing passwords on your servers and other devices.
But wait—there’s hope! That is, if you create a virtual LAN (VLAN) . You can solve many of the problems associated with layer 2 switching with VLANs, as you’ll soon see.
Here’s a short list of ways VLANs simplify network management:
- Network adds, moves, and changes are achieved with ease by just configuring a port into the appropriate VLAN.
- A group of users that need an unusually high level of security can be put into its own VLAN so that users outside of the VLAN can’t communicate with them.
- As a logical grouping of users by function, VLANs can be considered independent from their physical or geographic locations.
- VLANs greatly enhance network security.
- VLANs increase the number of broadcast domains while decreasing their size.
Coming up, I’m going to tell you all about switching characteristics and thoroughly describe how switches provide us with better network services than hubs can in our networks today.
Broadcasts occur in every protocol, but how often they occur depends upon three things:
- The type of protocol
- The application(s) running on the internetwork
- How these services are used
Some older applications have been rewritten to reduce their bandwidth appetites, but there’s a new generation of applications that are incredibly bandwidth greedy that will consume any and all they can find. These bandwidth gluttons are multimedia applications that use both broadcasts and multicasts extensively.
And faulty equipment, inadequate segmentation, and poorly designed firewalls seriously compound the problems that these broadcast-intensive applications create. All of this has added a major new dimension to network design and presents a bunch of new challenges for an administrator. Positively making sure your network is properly segmented so you can quickly isolate a single segment’s problems to preventthem from propagating throughout your entire internetwork is imperative! And the most effective way to do that is through strategic switching and routing.
Since switches have become more affordable lately, a lot of companies are replacing their flat hub networks with pure switched network and VLAN environments. All devices within a VLAN are members of the same broadcast domain and receive all broadcasts. By default, these broadcasts are filtered from all ports on a switch that aren’t members of the same VLAN. This is great because you get all the benefits you would with a switched design without getting hit with all the problems you’d have if all your users were in the same broadcast domain—sweet!
Okay, I know. There’s always a catch, though, right? Time to get back to those security issues. A flat internetwork’s security used to be tackled by connecting hubs and switches together with routers. So it was basically the router’s job to maintain security. This arrangement was pretty ineffective for several reasons. First, anyone connecting to the physical network could access the network resources located on that particular physical LAN. Second, all anyone had to do to observe any and all traffic happening in that network was to simply plug a network analyzer into the hub. And similar to that last ugly fact, users could join a workgroup by just plugging their workstations into the existing hub. That’s about as secure as an open barrel of honey in a bear enclosure!
But that’s exactly what makes VLANs so cool. If you build them and create multiple broadcast groups, you can have total control over each port and user! So the days when anyone could just plug their workstations into any switch port and gain access to network resources are history because now you get to control each port, plus whatever resources that port can access.
And it doesn’t end there my friends, because VLANs can be created in accordance with the network resources a given user requires, plus switches can be configured to inform a network management station of any unauthorized access to network resources. And if you need inter-VLAN communication, you can implement restrictions on a router to make sure that happens securely. You can also place restrictions on hardware addresses, protocols, and applications. Now we’re talking security—the honey barrel is now sealed, shrouded in razor wire, and made of solid titanium!
Flexibility and Scalability
If you were paying attention to what you’ve read so far, you know that layer 2 switches only read frames for filtering—they don’t look at the Network layer protocol. And by default, switches forward broadcasts to all ports. But if you create and implement VLANs, you’re essentially creating smaller broadcast domains at layer 2.
What this means is that broadcasts sent out from a node in one VLAN won’t be forwarded to ports configured to belong to a different VLAN. So by assigning switch ports or users to VLAN groups on a switch or group of connected switches, you gain the flexibility to add only the users you want into that broadcast domain regardless of their physical location. This setup can also work to block broadcast storms caused by a faulty network interface card (NIC) as well as prevent an intermediate device from propagating broadcast storms throughout the entire internetwork. Those evils can still happen on the VLAN where the problem originated, but the disease will instead be quarantined to that one ailing VLAN.
Another advantage is that when a VLAN gets too big, you can create more VLANs to keep the broadcasts from consuming too much bandwidth —the fewer users in a VLAN, the fewer users affected by broadcasts. This is all well and good, but you seriously need to keep network services in mind and understand how the users connect to these services when you create your VLAN. It’s a good move to try to keep all services, except for the email and Internet access that everyone needs, local to all users whenever possible.
To understand how a VLAN looks to a switch, it’s helpful to begin by first booking at a traditional network. Below Figure shows how a network was created by using hubs to connect physical LANs to a router.
Here you can see that each network is attached with a hub port to the router (each segment also has its own logical network number even though this isn’t obvious looking at the figure). Each node attached to a particular physical network has to match that network’s number in order to be able to communicate on the internetwork. Notice that each department has its own LAN, so if you needed to add new users to, let’s say, Sales, you would just plug them into the Sales LAN and they would automatically be part of the Sales collision and broadcast domain. This design really did work well for many years.
But there was one major flaw: What happens if the hub for Sales is full and we need to add another user to the Sales LAN? Or, what do we do if there’s no more physical space where the Sales team is located for this new employee? Well, let’s say there just happens to be plenty of room in the Finance section of the building. That new Sales team member will just have to sit on the same side of the building as the Finance people, and we’ll just plug the poor soul into the hub for Finance.
Doing this obviously makes the new user part of the Finance LAN, which is very bad for many reasons. First and foremost, we now have a majorsecurity issue. Because the new Sales employee is a member of the Finance broadcast domain, the newbie can see all the same servers and access all network services that the Finance folks can. Second, for this user to access the Sales network services they need to get their job done, they would have to go through the router to log in to the Sales server—not exactly efficient!
Now let’s look at what a switch accomplishes for us. Below Figure demonstrates how switches come to the rescue by removing the physical boundary to solve our problem. It also shows how six VLANs (numbered 2 through 7) are used to create a broadcast domain for each department. Each switch port is then administratively assigned a VLAN membership, depending on the host and which broadcast domain it’s to be placed in.
So now, if we needed to add another user to the Sales VLAN (VLAN 7), we could just assign the port to VLAN 7 regardless of where the new Sales team member is physically located—nice! This illustrates one of the sweetest advantages to designing your network with VLANs over the old collapsed backbone design. Now, cleanly and simply, each host that needs to be in the Sales VLAN is merely connected to a port assigned to VLAN 7.
Notice that I started assigning VLANs with VLAN number 2. The number is irrelevant, but you might be wondering what happened to VLAN 1? Well that VLAN is an administrative VLAN, and even though it can be used for a workgroup, Cisco recommends that you use it for administrative purposes only. You can’t delete or change the name of VLAN 1, and by default, all ports on a switch are members of VLAN 1 until you change them.
Since each VLAN is considered a broadcast domain, it’s got to also have its own subnet number (refer again to Figure 11-4). And if you’re also using IPv6, then each VLAN must also be assigned its own IPv6 network number. So you don’t get confused, just keep thinking of VLANs as separate subnets or networks.
According To WikiPedia What Is Vlan
If You Like This Post Comment Down
For More Networking Post Click Here