Cisco S3C3 Virtual LANS

Why VLANs? You can define groupings of workstations even if separated by switches and on different LAN segments –They are one collision domain, one VLAN, and one broadcast domain Faster Logical

Typical LAN Configuration Configured according to physical infrastructure –Users grouped based on location –Router interconnecting shared hubs typically provides segmentation and acts as broadcast firewall –Does not group users according to need for bandwidth

VLAN Introduction Group of ports or users can be in same broadcast domain Can be based on port ID, MAC address, protocol, or application software LAN switches and network management software provide mechanism to create VLANS Frame tagged with VLAN ID

VLAN Characteristics Work at Layer 2 and Layer 3 of OSI model Communications between VLANS is provided by Layer 3 routing VLANs provide a method of controlling network broadcasts Network administrator assigns users to VLAN Can increase network security by defining communication between nodes

VLAN Groups Coworkers in same department Cross-functional product team Diverse user groups sharing same network application or software Can be grouped on a single switch or on connected switches Can span single building infrastructures, interconnected buildings, or WANS

VLAN Transport Capabilities Remove physical boundaries between users Increase configuration flexibility of a VLAN solution when users move Provide mechanisms for interoperability between backbone system components Backbone carries end-user VLAN information and identification between switches, routers, and attached servers

Routers and VLANs Routers traditionally provide firewalls, broadcast management, and route processing VLAN switches take on some of these tasks Routers still have to provide connected routes between different VLANS and connect to other network segments Layer 3 is still integral part of high switching architecture Backbone connections can be ATM, Fast Ethernet, others

ATM/Fast Ethernet Connections Increase throughput between switches and routers Consolidate overall number of physical router ports required for communication between VLANs VLAN architecture provides logical segmentation and can enhance efficiency of a network

Frame Filtering Filtering table is developed for each switch Switches share address table information Table entries are compared with the frames Switch takes appropriate action

Frame Tagging Specifically developed for multi-VLAN, inter-switched communicators Places unique identifier in header of each frame as it travels across network backbone (vertical cabling) Identifier removed before frame exits switch on non-backbone links (horizontal cabling)

VLAN Trends Rapid evolution Movement from workgroup to enterprise implementation Need for logical segmentation across the backbone Frame tagging gaining recognition as the standard trunking mechanism (IEEE 802.1q)

Switch Intelligence Can make filtering and forwarding decisions by frame, based on VLAN metrics defined by network managers Can communicate information to other switches and routers within network Rules defined by administrator determine where frame is to be sent, filtered, or broadcasted

VLAN Operations Each switch port can be assigned to a VLAN Ports assigned to same VLAN share broadcast VLANs are port-centric, static, and dynamic

Port-Centric VLANS All nodes connected to ports in same VLAN are assigned to same VLAN ID –Users assigned by port –Easily administered –Increased security between VLANs –Packets do not leak into other domains

Static VLANs Ports on switch statically assigned to VLAN Maintain assigned VLAN configuration until changed –Secure –Easy to configure –Straightforward to monitor –Work well in networks in which moves are controlled and managed

Dynamic VLANs Ports on switch than can automatically determine VLAN assignment Assigned using centralized VLAN management application Based on MAC address, logical address, or protocol type Less administration in wiring closet Notification when unrecognized user is added to network

VLAN Facts 20% to 40% of workforce moves each year –Can require re-cabling, readdressing VLANs provide mechanism for controlling these changes and reducing cost VLANs are improvement over typical LAN-based techniques –Require less rewiring, configuration and debugging; router configuration left intact

VLAN & Broadcasts Broadcast traffic can result from multimedia applications Broadcasts can bring down network (storms) Firewalls segment network –Assign switch ports or users to specific VLAN groups within single switches and across multiple switches

Network Security Segment network into broadcast groups –Use router access lists based on Station addresses Application types Protocol types –Restrict number of users in VLAN group –New users must review approval –Configure all unused ports to default to low-service VLAN Add control lists; restrict access by address, application, protocol, or time of day

Connecting Hub Segments Can save money by connecting existing hubs to switches Each hub segment connected to switch port can be assigned to only one VLAN Stations that share a hub must be in same VLAN group