© 2006 Cisco Systems, Inc. All rights reserved.Cisco Public 1 VLANs

© 2006 Cisco Systems, Inc. All rights reserved.Cisco Public 2 Some requirements of LANs Separate Broadcast Domains  Need to split up broadcast domains to make good use of bandwidth  People in the same department may need to be grouped together.  Security: restrict access by certain users to some areas of the LAN

© 2006 Cisco Systems, Inc. All rights reserved.Cisco Public 3 Some requirements of LANs  Provide a way for different areas of the LAN to communicate with each other  Each LAN must have a on the backbone layer three device (router).  Each LAN must have a separate port on the backbone layer three device (router). Separate Broadcast Domains

© 2006 Cisco Systems, Inc. All rights reserved.Cisco Public 4 Solution using routers BUT  Routers are expensive  Routers are slower than switches  Subnets are restricted to limited physical areas  Subnets are inflexible

© 2006 Cisco Systems, Inc. All rights reserved.Cisco Public 5 Another Solution: Using VLANs in Switches  VLAN membership can be by function/port and not by location.  VLANs managed by switches

© 2006 Cisco Systems, Inc. All rights reserved.Cisco Public 6  VLANs provide segmentation based on.  VLANs provide segmentation based on broadcast domains.  VLANs logically segment switched networks based on the functions, project teams, or applications of the organization not by physical location.  Communication among VLANs still require a router. BUT, will handle all routing.  Communication among VLANs still require a router. BUT, only one physical connection will handle all routing. Separate Broadcast Domains Solution using VLANs

© 2006 Cisco Systems, Inc. All rights reserved.Cisco Public 7 Defining VLANs  A VLAN allows: Creation of groups of logically networked devices.  Each VLAN is a separate broadcast domain. Broadcast traffic is controlled.  Each VLAN is a separate IP subnet. The devices to act as if they are on their own independent network. To communicate among VLANs, you must use a router (MUCH more later).

© 2006 Cisco Systems, Inc. All rights reserved.Cisco Public 8 VLANs  A better design still creates the 3 separate broadcast domains but only requires 1 switch.  The router provides broadcast filtering over a single link. One Physical Link

© 2006 Cisco Systems, Inc. All rights reserved.Cisco Public 9 Benefits of VLANs  Security  Cost reduction  Higher performance  Broadcast storm mitigation  Improved IT staff efficiency and management.

© 2006 Cisco Systems, Inc. All rights reserved.Cisco Public 10 VLAN Numbers  VLAN information is stored in the VLAN database.  vlan.dat in the flash memory of the switch.

© 2006 Cisco Systems, Inc. All rights reserved.Cisco Public 11 VLAN Port Membership Modes

© 2006 Cisco Systems, Inc. All rights reserved.Cisco Public 12 Static VLAN (Port-centric)  Benefit of CLI mode, if a port is put on a VLAN and the VLAN does not exist, then the VLAN is created. So..  If VLAN 20 did not exist before – then it does now.

© 2006 Cisco Systems, Inc. All rights reserved.Cisco Public 13 Dynamic VLAN  Not widely used.  Use a VLAN Membership Policy Server (VMPS).  Assign a device to a VLAN based on its MAC address.  Connect device, server assigns VLAN.  Useful if you want to move devices around.

© 2006 Cisco Systems, Inc. All rights reserved.Cisco Public 14 Types of VLAN  Data or user VLAN  Voice VLAN  Management VLAN  Native VLAN  Default VLAN

© 2006 Cisco Systems, Inc. All rights reserved.Cisco Public 15 Data VLAN  Carry files, s, shared application traffic, most user traffic.  Separate VLAN for each group of users.

© 2006 Cisco Systems, Inc. All rights reserved.Cisco Public 16 Voice VLANs HAS SPECIAL requirements: to ensure voice quality.  Assured bandwidth to ensure voice quality. over other types of network traffic.  Transmission priority over other types of network traffic. around congested areas on the network.  Ability to be routed around congested areas on the network.  Delay of less than 150 milliseconds (ms) across the network. Voice VLAN

© 2006 Cisco Systems, Inc. All rights reserved.Cisco Public 17  Voice VLANs: VLAN 150 is designed to carry voice traffic. ConnectionsConnections Voice VLAN

© 2006 Cisco Systems, Inc. All rights reserved.Cisco Public 18 Ensures that voice traffic is identified as priority traffic. Voice VLAN Data VLAN Voice VLAN

© 2006 Cisco Systems, Inc. All rights reserved.Cisco Public 19 A Cisco IP Phone is a switch.  Voice VLANs: A Cisco IP Phone is a switch. Port 1 connects to the switch or VoIP device. Port 2 is an internal 10/100 interface that carries the phone traffic. Port 3 connects to a PC or other device. Voice VLAN

© 2006 Cisco Systems, Inc. All rights reserved.Cisco Public 20 A Cisco IP Phone is a switch.  Voice VLANs: A Cisco IP Phone is a switch. Switch S3 is configured to carry voice traffic on VLAN 150 and data traffic on VLAN 20. Sending: Phone tags voice traffic with VLAN 150 and sends data traffic untagged. The switch will tag the data traffic for VLAN 20. Sending: Receiving: Phone acts on voice traffic and removes the tag for data traffic destined for the PC. Receiving: MORE on the tagging process later… Voice VLAN

© 2006 Cisco Systems, Inc. All rights reserved.Cisco Public 21 A Cisco IP Phone is a switch.  Voice VLANs: A Cisco IP Phone is a switch. Link to the switch acts as a trunk link to carry both voice and data traffic. CDP is used to communicate between the switch and the phone. CDP Voice VLAN

© 2006 Cisco Systems, Inc. All rights reserved.Cisco Public 22 Voice VLANs : Sample Configuration

© 2006 Cisco Systems, Inc. All rights reserved.Cisco Public 23 Default VLAN  VLAN 1 on Cisco switches.  Carries CDP and STP (spanning tree protocol) traffic.  Initially all ports are in this VLAN.  Do not use it for data, voice or management traffic for security reasons.  Cannot rename or delete VLAN1.

© 2006 Cisco Systems, Inc. All rights reserved.Cisco Public 24 Default VLAN Switch

© 2006 Cisco Systems, Inc. All rights reserved.Cisco Public 25 Management and Native VLAN  Has the switch IP address.  Used for telnet/SSH or web access for management purposes.  Better not to use VLAN 1 for security reasons.

© 2006 Cisco Systems, Inc. All rights reserved.Cisco Public 26 VLAN Trunks  What problem does it solve? Network /24 Network /24 Network /24 Network /24

© 2006 Cisco Systems, Inc. All rights reserved.Cisco Public 27 Tag to identify VLAN  Tag is added to the frame when it goes on to the trunk  Tag is removed when it leaves the trunk

© 2006 Cisco Systems, Inc. All rights reserved.Cisco Public 28 Frame tagging IEEE 802.1Q Dest AddSource AddType/LenDataFCSDest AddSource AddType/LenDataFCSTag Normal frame Add 4-byte tag, recalculate FCS Tag protocol ID 0x8100 PriorityCFI for token ring VLAN ID

© 2006 Cisco Systems, Inc. All rights reserved.Cisco Public 29 Native VLAN and 802.1Q Trunking  Tagged Frames on Native VLAN  Control traffic sent on the native VLAN should be untagged.  Switch will drop tagged frames received from the native VLAN.  Devices from other vendors that support tagged frames on the native VLAN include IP phones, servers, routers, and non-Cisco switches.

© 2006 Cisco Systems, Inc. All rights reserved.Cisco Public 30  Configure the trunk to default to native VLAN 1.  Configure the trunk for native VLAN 99. Configure trunk port  By default native VLAN is 1.

© 2006 Cisco Systems, Inc. All rights reserved.Cisco Public 31 Verification of Trunk Port

© 2006 Cisco Systems, Inc. All rights reserved.Cisco Public 32 Trunking Operation PC1 and PC3 send a broadcast S2 receives the frames and ‘tags’ them with the VLAN ID. The tagged frames are sent across the trunk links between S2 and S1 and S1 and S3. S3 strips the tags and forwards to the destination.

© 2006 Cisco Systems, Inc. All rights reserved.Cisco Public 33 Dynamic Trunking Protocol (DTP): Cisco proprietary protocol. Switches from other vendors do not support DTP. DTP manages trunk negotiation only if the port on the other switch is configured in a trunk mode that supports DTP.

© 2006 Cisco Systems, Inc. All rights reserved.Cisco Public 34 DTP Modes

© 2006 Cisco Systems, Inc. All rights reserved.Cisco Public 35 Trunking Modes Access Mode Trunk Mode

© 2006 Cisco Systems, Inc. All rights reserved.Cisco Public 36 Controlling Broadcast Domains with VLANs  Intra-VLAN Communications:

© 2006 Cisco Systems, Inc. All rights reserved.Cisco Public 37 Controlling Broadcast Domains with VLANs :  Intra-VLAN Communications :

© 2006 Cisco Systems, Inc. All rights reserved.Cisco Public 38 Controlling Broadcast Domains with VLANs  Intra-VLAN Communications:

© 2006 Cisco Systems, Inc. All rights reserved.Cisco Public 39 Controlling Broadcast Domains with VLANs  Intra-VLAN Communications:

© 2006 Cisco Systems, Inc. All rights reserved.Cisco Public 40 Layer 3 Switch Forwarding  Layer 3 Switch: A Layer 3 switch has the ability to route transmissions between VLANs. The procedure is the same as described for the inter-VLAN communication using a separate router.  Switch Virtual interface (SVI): A logical interface (SVI) is configured for each VLAN configured on the switch.

© 2006 Cisco Systems, Inc. All rights reserved.Cisco Public 41 Layer 3 Switch Forwarding  Layer 3 Switch : Contains the SVI 20 information…NOT SVI 10 SVI 10 knows about SVI 20 (the location of VLAN 20).

© 2006 Cisco Systems, Inc. All rights reserved.Cisco Public 42 Configure VLANs on the Switches in a Converged Network Topology  The steps to configure trunks and VLANs

© 2006 Cisco Systems, Inc. All rights reserved.Cisco Public 43 Creating and Naming VLANs  For verification, use the command S1 # show VLAN brief

© 2006 Cisco Systems, Inc. All rights reserved.Cisco Public 44 Configure a VLAN Verify VLAN configuration

© 2006 Cisco Systems, Inc. All rights reserved.Cisco Public 45 Show commands

© 2006 Cisco Systems, Inc. All rights reserved.Cisco Public 46 Show commands output  S1#show VLAN name student  S1#show VLAN summary

© 2006 Cisco Systems, Inc. All rights reserved.Cisco Public 47 Assign switchport

© 2006 Cisco Systems, Inc. All rights reserved.Cisco Public 48 Verification of port memberships  S1#show vlan brief

© 2006 Cisco Systems, Inc. All rights reserved.Cisco Public 49  S1#show interfaces fa0/18 switchport Verification of port memberships

© 2006 Cisco Systems, Inc. All rights reserved.Cisco Public 50 Managing VLANs  Remove vlan 20 from switchport fa 0/18.  Verification

© 2006 Cisco Systems, Inc. All rights reserved.Cisco Public 51 Managing VLANs - Reassignment  Reassigning vlan20 to port fa0/11  Verification

© 2006 Cisco Systems, Inc. All rights reserved.Cisco Public 52 SW1(config)#no vlan 20 SW1(config)#end  VLAN 20 is deleted.  Any ports still on VLAN 20 will be inactive. They need to be reassigned. SW1#delete flash:vlan.dat  Erasing the startup configuration does not get rid of VLANs because they are saved in a separate file.  Switch goes back to the default with all ports in VLAN 1.  You cannot delete VLAN 1. Managing VLANs – Deleting VLANs

© 2006 Cisco Systems, Inc. All rights reserved.Cisco Public 53 Deleting VLANs  Before deletion.  After deletion.

© 2006 Cisco Systems, Inc. All rights reserved.Cisco Public 54 Configure Trunk Ports

© 2006 Cisco Systems, Inc. All rights reserved.Cisco Public 55 Configuring Trunk Ports

© 2006 Cisco Systems, Inc. All rights reserved.Cisco Public 56 Verification  Verification native trunk

© 2006 Cisco Systems, Inc. All rights reserved.Cisco Public 57 Managing Trunks  Reset Example  Remove Example

© 2006 Cisco Systems, Inc. All rights reserved.Cisco Public 58 Common Software or Hardware Misconfigurations Associated with VLANs

© 2006 Cisco Systems, Inc. All rights reserved.Cisco Public 59 Native VLAN Mismatch

© 2006 Cisco Systems, Inc. All rights reserved.Cisco Public 60 Native VLAN Mismatch - Solution  Output from Switch 3  Output from Computer PC4

© 2006 Cisco Systems, Inc. All rights reserved.Cisco Public 61 Trunk Mode Mismatch  Outputs from Switch 1  Outputs from Switch 3

© 2006 Cisco Systems, Inc. All rights reserved.Cisco Public 62 Trunk Mode Mismatch-Solution  Output from Switch 1  Output from Switch 3  Output from Computer PC4

© 2006 Cisco Systems, Inc. All rights reserved.Cisco Public 63 Incorrect VLAN List  Output from Switch 3  Output from Switch 1

© 2006 Cisco Systems, Inc. All rights reserved.Cisco Public 64  Outputs from Switch 1  Output from Computer PC5 Incorrect VLAN List - Solution

© 2006 Cisco Systems, Inc. All rights reserved.Cisco Public 65 VLANs and IP Subnets

© 2006 Cisco Systems, Inc. All rights reserved.Cisco Public 66 VLANs and IP Subnets - Solution