Virtual LAN (VLAN) W.lilakiatsakun. VLAN Overview (1) A VLAN allows a network administrator to create groups of logically networked devices that act as.

Slides:



Advertisements
Similar presentations
© 2006 Cisco Systems, Inc. All rights reserved.Cisco Public 1 Version 4.0 VLANs LAN Switching and Wireless – Chapter 3.
Advertisements

© 2006 Cisco Systems, Inc. All rights reserved. ICND v2.3—2-1 Extending Switched Networks with Virtual LANs Introducing VLAN Operations.
© 2008 Cisco Systems, Inc. All rights reserved.Cisco ConfidentialPresentation_ID 1 Chapter 3: VLANs Routing & Switching.
Virtual LANs.
Oct 12, 2004CS573: Network Protocols and Standards1 Virtual LANs Network Protocols and Standards Autumn
© 2008 Cisco Systems, Inc. All rights reserved.Cisco ConfidentialPresentation_ID 1 Chapter 3: VLANs Routing & Switching.
© 2006 Cisco Systems, Inc. All rights reserved.Cisco PublicITE I Chapter 6 1 VLANs LAN Switching and Wireless – Chapter 3.
Institute of Technology, Sligo Dept of Computing Semester 3, version Semester 3 Chapter 3 VLANs.
VLANs- Chapter 3 CCNA Exploration Semester 3 Modified by Profs. Ward
© Wiley Inc All Rights Reserved. CCNA: Cisco Certified Network Associate Study Guide CHAPTER 8: Virtual LANs (VLANs)
Virtual LANs. VLAN introduction VLANs logically segment switched networks based on the functions, project teams, or applications of the organization regardless.
We will be covering VLANs this week. In addition we will do a practical involving setting up a router and how to create a VLAN.
Sybex CCNA Chapter 9: VLAN’s Instructor & Todd Lammle.
VLANs.ppt CCNA Exploration Semester 3 Chapter 3
VLAN Trunking Protocol (VTP) W.lilakiatsakun. VLAN Management Challenge (1) It is not difficult to add new VLAN for a small network.
Virtual LAN (VLAN) W.lilakiatsakun.
Voice VLANs Lecture 7 VLANs.ppt 21/04/ Apr-17
© 2008 Cisco Systems, Inc. All rights reserved.Cisco ConfidentialPresentation_ID 1 Chapter 3: Implementing VLAN Security Routing And Switching.
Virtual LAN Design Switches also have enabled the creation of Virtual LANs (VLANs). VLANs provide greater opportunities to manage the flow of traffic on.
Sybex CCNA Chapter 11: VLAN’s Instructor & Todd Lammle.
VLAN Trunking Protocol
VLAN Trunking Protocol (VTP)
The University of Bolton School of Business & Creative Technologies MWD1014 Computer Networks Virtual Local Area Networks (VLANs) Martin Stanhope
VLAN V irtual L ocal A rea N etwork VLAN Network performance is a key factor in the productivity of an organization. One of the technologies used to.
Chapter 8: Virtual LAN (VLAN)
© 2006 Cisco Systems, Inc. All rights reserved.Cisco PublicITE I Chapter 6 1 VLANs LAN Switching and Wireless – Chapter 3 Sandra Coleman, CCNA, CCAI.
Lecture2 Secured Network Design W.Lilakiatsakun.  ARP  Problems with ARP / Countermeasures  VLAN  Attacking on VLAN / Countermeasures Topics.
© 2006 Cisco Systems, Inc. All rights reserved.Cisco PublicITE I Chapter 6 1 Configure a Switch LAN Switching and Wireless – Chapter 3.
VLAN-1 Virtual Local Area Networks (VLANs). VLAN-2 Virtual Local Area Networks Introducing VLANs.
CS 540 Computer Networks II
Cisco 3 - LAN Perrine. J Page 110/20/2015 Chapter 8 VLAN VLAN: is a logical grouping grouped by: function department application VLAN configuration is.
© 2002, Cisco Systems, Inc. All rights reserved..
© 2008 Cisco Systems, Inc. All rights reserved.Cisco ConfidentialPresentation_ID 1 Chapter 3: Implementing VLAN Security Routing And Switching.
1 © 2003, Cisco Systems, Inc. All rights reserved. CCNA 3 v3.0 Module 8 Virtual LANs.
© 2008 Cisco Systems, Inc. All rights reserved.Cisco ConfidentialPresentation_ID 1 Chapter 3: Implementing VLAN Security Routing And Switching 3.0.
1 © 2003, Cisco Systems, Inc. All rights reserved. CCNA 3 v3.0 Module 9 Virtual Trunking Protocol.
1 © 2003, Cisco Systems, Inc. All rights reserved. CCNA 3 v3.0 Module 8 Virtual LANs Cisco Networking Academy.
© 2006 Cisco Systems, Inc. All rights reserved.Cisco PublicITE I Chapter 6 1 VLANs LAN Switching and Wireless – Chapter 3.
Switching Topic 2 VLANs.
© 2006 Cisco Systems, Inc. All rights reserved.Cisco PublicITE I Chapter 6 1 Switching in an Enterprise Network Introducing Routing and Switching in the.
Virtual Local Area Networks (VLANs) Part II
Configuring VLAN Chapter 14 powered by DJ 1. Chapter Objectives At the end of this Chapter you will be able to:  Understand basic concept of VLAN  Configure.
Chapter 4 Version 1 Virtual LANs. Introduction By default, switches forward broadcasts, this means that all segments connected to a switch are in one.
VLANs Last Update Copyright Kenneth M. Chipps Ph.D.
W&L Page 1 CCNA CCNA Training 2.5 Describe how VLANs create logically separate networks and the need for routing between them Jose Luis.
1 VLANs Relates to Lab 6. Short module on basics of VLAN switching.
© 2008 Cisco Systems, Inc. All rights reserved.Cisco ConfidentialPresentation_ID 1 Chapter 3: VLANs Routing & Switching.
Virtual LAN (VLAN) W.lilakiatsakun.
VTP VLAN Trunking Protocol Create once and send to the other switches. VTP is a messaging protocol that uses Layer 2 trunk frames to manage the addition,
+ Lecture#8: VLAN Asma AlOsaimi Topics VLAN Segmentation VLAN Implementation VLAN Security and Design 3.0.
LAN Switching Virtual LANs. Virtual LAN Concepts A LAN includes all devices in the same broadcast domain. A broadcast domain includes the set of all LAN-connected.
Exploration 3 Chapter 4. What is VTP? VTP allows a network manager to configure a switch so that it will propagate VLAN configurations to other switches.
© 2006 Cisco Systems, Inc. All rights reserved.Cisco Public 1 VLANs.
Virtual Local Area Networks In Security By Mark Reed.
© 2006 Cisco Systems, Inc. All rights reserved.Cisco Public 1 VLANs.
Instructor Materials Chapter 2: Scaling VLANs
Chap 3 – Virtual LANs (VLANs) Learning Objectives
By Ashar Anwar.
© 2002, Cisco Systems, Inc. All rights reserved.
Instructor Materials Chapter 6: VLANs
Virtual Local Area Networks (VLANs) Part I
LAN Switching and Wireless – Chapter 3
Virtual LANs.
Chapter 2: Scaling VLANs
Virtual Local Area Network
Routing and Switching Essentials v6.0
CCNA Routing and Switching Routing and Switching Essentials v6.0
Chapter 3: Implementing VLAN Security
Chapter 2: Scaling VLANs
Presentation transcript:

Virtual LAN (VLAN) W.lilakiatsakun

VLAN Overview (1) A VLAN allows a network administrator to create groups of logically networked devices that act as if they are on their own independent network, even if they share a common infrastructure with other VLANs. A VLAN allows a network administrator to create groups of logically networked devices that act as if they are on their own independent network, even if they share a common infrastructure with other VLANs. Using VLANs, you can logically segment switched networks based on functions, departments, or project teams. Using VLANs, you can logically segment switched networks based on functions, departments, or project teams. You can also use a VLAN to geographically structure your network to support the growing reliance of companies on home-based workers. You can also use a VLAN to geographically structure your network to support the growing reliance of companies on home-based workers. These VLANs allow the network administrator to implement access and security policies to particular groups of users. These VLANs allow the network administrator to implement access and security policies to particular groups of users.

VLAN Overview (2)

VLAN in details (1) A VLAN is a logically separate IP subnetwork. A VLAN is a logically separate IP subnetwork. VLANs allow multiple IP networks and subnets to exist on the same switched network. VLANs allow multiple IP networks and subnets to exist on the same switched network. For computers to communicate on the same VLAN, each must have an IP address and a subnet mask that is consistent for that VLAN. For computers to communicate on the same VLAN, each must have an IP address and a subnet mask that is consistent for that VLAN. The switch has to be configured with the VLAN and each port in the VLAN must be assigned to the VLAN. The switch has to be configured with the VLAN and each port in the VLAN must be assigned to the VLAN.

VLAN in details (2) A switch port with a singular VLAN configured on it is called an access port. A switch port with a singular VLAN configured on it is called an access port. Remember, just because two computers are physically connected to the same switch does not mean that they can communicate. Remember, just because two computers are physically connected to the same switch does not mean that they can communicate. Devices on two separate networks and subnets must communicate via a router (Layer 3), whether or not VLANs are used. Devices on two separate networks and subnets must communicate via a router (Layer 3), whether or not VLANs are used.

VLAN in details (3)

Benefits of VLAN (1) Security - Groups that have sensitive data are separated from the rest of the network, decreasing the chances of confidential information breaches. Security - Groups that have sensitive data are separated from the rest of the network, decreasing the chances of confidential information breaches. –Faculty computers are on VLAN 10 and completely separated from student and guest data traffic. Cost reduction - Cost savings result from less need for expensive network upgrades and more efficient use of existing bandwidth and uplinks. Cost reduction - Cost savings result from less need for expensive network upgrades and more efficient use of existing bandwidth and uplinks.

Benefits of VLAN (2) Higher performance - Dividing flat Layer 2 networks into multiple logical workgroups (broadcast domains) reduces unnecessary traffic on the network and boosts performance. Higher performance - Dividing flat Layer 2 networks into multiple logical workgroups (broadcast domains) reduces unnecessary traffic on the network and boosts performance. Broadcast storm mitigation - Dividing a network into VLANs reduces the number of devices that may participate in a broadcast storm. Broadcast storm mitigation - Dividing a network into VLANs reduces the number of devices that may participate in a broadcast storm. –In the figure you can see that although there are six computers on this network, there are only three broadcast domains: Faculty, Student, and Guest.

Benefits of VLAN (3)

Benefits of VLAN (4) Improved IT staff efficiency - VLANs make it easier to manage the network because users with similar network requirements share the same VLAN. Improved IT staff efficiency - VLANs make it easier to manage the network because users with similar network requirements share the same VLAN. –When you provision a new switch, all the policies and procedures already configured for the particular VLAN are implemented when the ports are assigned. –It is also easy for the IT staff to identify the function of a VLAN by giving it an appropriate name. –In the figure, for easy identification VLAN 20 could be named "Student", VLAN 10 could be named "Faculty", and VLAN 30 "Guest."

Benefits of VLAN (5) Simpler project or application management - VLANs aggregate users and network devices to support business or geographic requirements. Simpler project or application management - VLANs aggregate users and network devices to support business or geographic requirements. –Having separate functions makes managing a project or working with a specialized application easier, for example, an e-learning development platform for faculty. –It is also easier to determine the scope of the effects of upgrading network services.

Introducing VLANs (1) VLAN ID Ranges - Access VLANs are divided into either a normal range or an extended range. VLAN ID Ranges - Access VLANs are divided into either a normal range or an extended range. Normal Range VLANs -Used in small- and medium-sized business and enterprise networks. Normal Range VLANs -Used in small- and medium-sized business and enterprise networks. Identified by a VLAN ID between 1 and Identified by a VLAN ID between 1 and –IDs 1002 through 1005 are reserved for Token Ring and FDDI VLANs. –IDs 1 and 1002 to 1005 are automatically created and cannot be removed. –Configurations are stored within a VLAN database file, called vlan.dat. –The vlan.dat file is located in the flash memory of the switch. The VLAN trunking protocol (VTP), which helps manage VLAN configurations between switches, can only learn normal range VLANs and stores them in the VLAN database file. The VLAN trunking protocol (VTP), which helps manage VLAN configurations between switches, can only learn normal range VLANs and stores them in the VLAN database file.

Introducing VLANs (2) Extended Range VLANs - Enable service providers to extend their infrastructure to a greater number of customers. Extended Range VLANs - Enable service providers to extend their infrastructure to a greater number of customers. –Some global enterprises could be large enough to need extended range VLAN IDs. –Are identified by a VLAN ID between 1006 and –Support fewer VLAN features than normal range VLANs. –Are saved in the running configuration file. –VTP does not learn extended range VLANs.

Introducing VLANs (3) 255 VLANs Configurable 255 VLANs Configurable –One Cisco Catalyst 2960 switch can support up to 255 normal range and extended range VLANs, although the number configured affects the performance of the switch hardware.

Introducing VLANs (4)

Types of VLANs - Data VLAN (1) Data VLAN - a VLAN that is configured to carry only user-generated traffic. Data VLAN - a VLAN that is configured to carry only user-generated traffic. It is common practice to separate voice and management traffic from data traffic. It is common practice to separate voice and management traffic from data traffic. A data VLAN is sometimes referred to as a user VLAN. A data VLAN is sometimes referred to as a user VLAN.

Types of VLANs - Data VLAN (2) Data VLAN

Types of VLANs- Default VLAN (1) All switch ports become a member of the default VLAN after the initial boot up of the switch. All switch ports become a member of the default VLAN after the initial boot up of the switch. –Having all the switch ports participate in the default VLAN makes them all part of the same broadcast domain. –This allows any device connected to any switch port to communicate with other devices on other switch ports. –The default VLAN for Cisco switches is VLAN 1. –VLAN 1 has all the features of any VLAN, except that you cannot rename it and you can not delete it.

Types of VLANs- Default VLAN (2) –Layer 2 control traffic, such as CDP and spanning tree protocol traffic, will always be associated with VLAN 1,this cannot be changed. –In the figure, VLAN 1 traffic is forwarded over the VLAN trunks connecting the S1, S2, and S3 switches. –It is a security best practice to change the default VLAN to a VLAN other than VLAN 1; this entails configuring all the ports on the switch to be associated with a default VLAN other than VLAN 1.

Types of VLANs- Default VLAN (3) Default VLAN

Types of VLANs - Native VLAN (1) A native VLAN is assigned to an 802.1Q trunk port. A native VLAN is assigned to an 802.1Q trunk port. –An 802.1Q trunk port supports traffic coming from many VLANs (tagged traffic) as well as traffic that does not come from a VLAN (untagged traffic). –The 802.1Q trunk port places untagged traffic on the native VLAN. –In the figure, the native VLAN is VLAN 99. –Untagged traffic is generated by a computer attached to a switch port that is configured with the native VLAN.

Types of VLANs - Native VLAN (2) Native VLANs are set out in the IEEE 802.1Q specification to maintain backward compatibility with untagged traffic common to legacy LAN scenarios. Native VLANs are set out in the IEEE 802.1Q specification to maintain backward compatibility with untagged traffic common to legacy LAN scenarios. It is a best practice to use a VLAN other than VLAN 1 as the native VLAN. It is a best practice to use a VLAN other than VLAN 1 as the native VLAN.

Types of VLANs - Native VLAN (3)

Types of VLANs - Management VLAN (1) A management VLAN is any VLAN you configure to access the management capabilities of a switch. A management VLAN is any VLAN you configure to access the management capabilities of a switch. –You assign the management VLAN an IP address and subnet mask. –A switch can be managed via HTTP, Telnet, SSH, or SNMP. –VLAN 1 is normally used as the default VLAN, –VLAN1 would be a bad choice as the management VLAN; you wouldn't want an arbitrary user connecting to a switch to default to the management VLAN.

Types of VLANs - Management VLAN (2)

VLAN Switch Port (1) Static VLAN - Ports on a switch are manually assigned to a VLAN. Static VLAN - Ports on a switch are manually assigned to a VLAN. –Static VLANs are configured using the Cisco CLI. –This can also be accomplished with GUI management applications, such as the Cisco Network Assistant. Dynamic VLAN - This mode is not widely used in production networks. Dynamic VLAN - This mode is not widely used in production networks. –A dynamic port VLAN membership is configured using a special server called a VLAN Membership Policy Server (VMPS). –With the VMPS, you assign switch ports to VLANs dynamically, based on the source MAC address of the device connected to the port. –The benefit comes when you move a host from a port on one switch in the network to a port on another switch in the network-the switch dynamically assigns the new port to the proper VLAN for that host.

VLAN Switch Port (2) Voice VLAN - A port is configured to be in voice mode so that it can support an IP phone attached to it. Voice VLAN - A port is configured to be in voice mode so that it can support an IP phone attached to it. It is assumed that the network has been configured to ensure that voice traffic can be transmitted with a priority status over the network. It is assumed that the network has been configured to ensure that voice traffic can be transmitted with a priority status over the network. When a phone is first plugged into a switch port that is in voice mode, the switch port sends messages to the phone providing the phone with the appropriate voice VLAN ID and configuration. When a phone is first plugged into a switch port that is in voice mode, the switch port sends messages to the phone providing the phone with the appropriate voice VLAN ID and configuration. The IP phone tags the voice frames with the voice VLAN ID and forwards all voice traffic through the voice VLAN. The IP phone tags the voice frames with the voice VLAN ID and forwards all voice traffic through the voice VLAN.

VLAN Switch Port (3)

VLAN Switch Port (4)

Controlling Broadcast Domain (1)

Controlling Broadcast Domain (2)

Layer3 forwarding (1)

Layer3 forwarding (2)

VLAN Trunk (1) A trunk is a point-to-point link between one or more Ethernet switch interfaces and another networking device, such as a router or a switch. A trunk is a point-to-point link between one or more Ethernet switch interfaces and another networking device, such as a router or a switch. Ethernet trunks carry the traffic of multiple VLANs over a single link. Ethernet trunks carry the traffic of multiple VLANs over a single link. A VLAN trunk allows you to extend the VLANs across an entire network. A VLAN trunk allows you to extend the VLANs across an entire network. Cisco supports IEEE 802.1Q for coordinating trunks on Fast Ethernet and Gigabit Ethernet interfaces. Cisco supports IEEE 802.1Q for coordinating trunks on Fast Ethernet and Gigabit Ethernet interfaces.

VLAN Trunk (2)

VLAN Trunk (3) Without VLAN trunking

VLAN Trunk (4) With VLAN trunks

VLAN Trunk Q Frame tagging (1) The VLAN tag field consists of an EtherType field, a tag control information field,and the FCS field. The VLAN tag field consists of an EtherType field, a tag control information field,and the FCS field. EtherType field EtherType field –Set to the hexadecimal value of 0x8100. –This value is called the tag protocol ID (TPID) value. –With the EtherType field set to the TPID value, the switch receiving the frame knows to look for information in the tag control information field.

VLAN Trunk Q Frame tagging (2) Tag control information field Tag control information field –3 bits of user priority - Used by the 802.1p standard, which specifies how to provide expedited transmission of Layer 2 frames. –1 bit of Canonical Format Identifier (CFI) - Enables Token Ring frames to be carried across Ethernet links easily. –12 bits of VLAN ID (VID) - VLAN identification numbers; supports up to 4096 VLAN IDs. FCS field FCS field –After the switch inserts the EtherType and tag control information fields, it recalculates the FCS values and inserts it into the frame.

VLAN Trunk Q Frame tagging (3)

VLAN Trunk –Native VLAN (1) Tagged Frames on the Native VLAN Tagged Frames on the Native VLAN Control traffic sent on the native VLAN should be untagged. Control traffic sent on the native VLAN should be untagged. If an 802.1Q trunk port receives a tagged frame on the native VLAN, it drops the frame. If an 802.1Q trunk port receives a tagged frame on the native VLAN, it drops the frame. –Consequently, when configuring a switch port on a Cisco switch, you need to identify these devices and configure them so that they do not send tagged frames on the native VLAN.

VLAN Trunk –Native VLAN (2) Untagged Frames on the Native VLAN Untagged Frames on the Native VLAN When a Cisco switch trunk port receives untagged frames it forwards those frames to the native VLAN. When a Cisco switch trunk port receives untagged frames it forwards those frames to the native VLAN. The default native VLAN is VLAN 1. The default native VLAN is VLAN 1. When you configure an 802.1Q trunk port, a default Port VLAN ID (PVID) is assigned the value of the native VLAN ID. When you configure an 802.1Q trunk port, a default Port VLAN ID (PVID) is assigned the value of the native VLAN ID. All untagged traffic coming in or out of the 802.1Q port is forwarded based on the PVID value. All untagged traffic coming in or out of the 802.1Q port is forwarded based on the PVID value. –For example, if VLAN 99 is configured as the native VLAN, the PVID is 99 and all untagged traffic is forward to VLAN 99. –If the native VLAN has not been reconfigured, the PVID value is set to VLAN 1.

VLAN Trunk –Native VLAN (3)

Configuring VLANs and Trunks

Configuring VLANs (1)

Configuring VLANs (2)

Configuring VLANs(3)

Configuring VLANs(4)

Verifying VLAN (1)

Verifying VLAN (2)

Verifying VLAN (3)

Managing Port (1)

Managing Port (2) Delete VLANs Delete VLANs Alternatively, the entire vlan.dat file can be deleted using the command delete flash:vlan.dat from privileged EXEC mode. Alternatively, the entire vlan.dat file can be deleted using the command delete flash:vlan.dat from privileged EXEC mode. After the switch is reloaded, the previously configured VLANs will no longer be present. After the switch is reloaded, the previously configured VLANs will no longer be present. This effectively places the switch into is "factory default" concerning VLAN configurations. This effectively places the switch into is "factory default" concerning VLAN configurations.

Configure a Trunk (1)

Configure a Trunk (2)

Verify a Trunk (2)

Managing a Trunk (1)

Managing a Trunk (2)

Common problems with trunks

Native VLAN Mismatches (1)

Native VLAN Mismatches (2)

Trunk mode mismatches (1)

Trunk mode mismatches (2)

Incorrect VLAN List (1)

Incorrect VLAN List (2)

VLAN and IP subnet