1. Chap 3 – Virtual LANs (VLANs) Learning Objectives
Explain the role of VLANs in a converged network.
Explain the role of trunking VLANs in a converged network.
Configure VLANs on the switches in a converged network topology.
Troubleshoot the common software or hardware mis-configurations associated with VLANs on switches in a converged network topology.

2. Introduction to VLANs Traditional LAN Segmentation
Virtual LAN Segmentation
A VLAN is a logical group of network stations, services, and devices that is not restricted to a physical LAN segment.
VLANs facilitate easy administration of logical groups of stations and servers that can communicate as if they were on the same physical LAN segment. They also facilitate easier administration of moves, adds, and changes in members of these groups.
VLANs logically segment switched networks based on job functions, departments, or project teams, regardless of the physical location of users or physical connections to the network.
All workstations and servers used by a particular workgroup share the same VLAN, regardless of the physical connection or location.
Configuration or reconfiguration of VLANs is done through software. Therefore, VLAN configuration does not require network equipment to be physically moved or connected.

3. VLANs – Broadcast Domains
A workstation in a VLAN group is restricted to communicating with file servers in the same VLAN group.
VLANs logically segment the network into different broadcast domains so that packets are only switched between ports that are assigned to the same VLAN.
VLANs are created to provide segmentation services traditionally provided by physical routers in LAN configurations. VLANs address scalability, security, and network management.
Routers in VLAN topologies provide broadcast filtering, security, and traffic flow management. Switches do not bridge traffic between VLANs, as this violates the integrity of the VLAN broadcast domain.
A VLAN is a logically separate IP subnetwork. VLANs allow multiple IP networks and subnets to exist on the same switched network. Traffic should only be routed (layer 3 switching) between VLANs.

4. VLANs – Broadcast Domains
In the slide, three separate switches are used to create three separate broadcast domains.
Layer 3 routing allows the router to send packets to the three different broadcast domains.
Three separate broadcast domains exist. The router routes traffic between the VLANs using Layer 3 routing. The switches forward frames to the router interfaces if certain circumstances exist:
If it is a broadcast frame
If the destination is one of the MAC addresses on the router
If Workstation 1 on the Engineering VLAN wants to send frames to Workstation 2 on the Sales VLAN, the frames are sent to the Fa0/0 MAC address of the router.
Routing occurs through the IP address on the Fa0/0 router interface for the Engineering VLAN.

5. Advantages of VLANs
Security - Groups that have sensitive data can be separated from the rest of the network.
Cost reduction - Cost savings result from more efficient use of existing bandwidth and uplinks.
Higher performance - reduces unnecessary traffic on the network, boosting performance.
Improved IT staff efficiency - VLANs make it easier to manage the network because users with similar network requirements share the same VLAN.
Security - Groups that have sensitive data are separated from the rest of the network, decreasing the chances of confidential information breaches.
Cost reduction - Cost savings result from less need for expensive network upgrades and more efficient use of existing bandwidth and uplinks.
Higher performance - Dividing flat Layer 2 networks into multiple logical workgroups (broadcast domains) reduces unnecessary traffic on the network and boosts performance.
Broadcast storm mitigation - Dividing a network into VLANs reduces the number of devices that may participate in a broadcast storm. LAN segmentation prevents a broadcast storm from propagating to the whole network.
Improved IT staff efficiency - VLANs make it easier to manage the network because users with similar network requirements share the same VLAN. When you provision a new switch, all the policies and procedures already configured for the particular VLAN are implemented when the ports are assigned. It is also easy for the IT staff to identify the function of a VLAN by giving it an appropriate name.
Simpler project or application management - VLANs aggregate users and network devices to support business or geographic requirements. Having separate functions makes managing a project or working with a specialized application easier, for example, an e-learning development platform for faculty. It is also easier to determine the scope of the effects of upgrading network services.

6. VLANs – Broadcast Domains
VLAN implementation on a switch causes certain actions to occur:
The switch maintains a separate bridging table for each VLAN.
If the frame comes in on a port in VLAN 1, the switch searches the bridging table for VLAN 1.
When the frame is received, the switch adds the source MAC address to the bridging table if it is currently unknown.
The destination is checked so a forwarding decision can be made.
For learning and forwarding, the search is made against the address table for that VLAN only.
In the slide, three separate switches are used to create three separate broadcast domains.
Layer 3 routing allows the router to send packets to the three different broadcast domains.
Three separate broadcast domains exist. The router routes traffic between the VLANs using Layer 3 routing. The switches forward frames to the router interfaces if certain circumstances exist:
If it is a broadcast frame
If the destination is one of the MAC addresses on the router
If Workstation 1 on the Engineering VLAN wants to send frames to Workstation 2 on the Sales VLAN, the frames are sent to the Fa0/0 MAC address of the router.
Routing occurs through the IP address on the Fa0/0 router interface for the Engineering VLAN.

7. Normal Range VLANs
Used in small- and medium-sized business and enterprise networks.
Identified by a VLAN ID between 1 and 1005.
IDs 1002 through 1005 are reserved for Token Ring and FDDI VLANs.
IDs 1 and 1002 to 1005 are automatically created and cannot be removed.
Configurations are stored within a VLAN database file, called vlan.dat. The vlan.dat file is located in the flash memory of the switch.
The VLAN trunking protocol (VTP), which helps manage VLAN configurations between switches, can only learn normal range VLANs and stores them in the VLAN database file.

8. Extended Range VLANs
Enable service providers to extend their infrastructure to a greater number of customers. Some global enterprises could be large enough to need extended range VLAN IDs.
Are identified by a VLAN ID between 1006 and 4094.
Supports fewer VLAN features than normal range VLANs.
Are saved in the running configuration file.
VTP does not learn extended range VLANs.
One Cisco Catalyst 2960 switch can support up to 255 normal range and extended range VLANs, although the number configured affects the performance of the switch hardware.
Because an enterprise network may need a switch with a lot of ports, Cisco has developed enterprise-level switches that can be joined or stacked together to create a single switching unit consisting of nine separate switches.
Each separate switch can have 48 ports, which totals 432 ports on a single switching unit. In this case, the 255 VLAN limit per single switch could be a constraint for some enterprise customers.

9. VLAN Types
A data VLAN is a VLAN that is configured to carry only user-generated traffic. A VLAN could carry voice-based traffic or traffic used to manage the switch, but this traffic would not be part of a data VLAN.
Management
VLAN 99
/24
Fa0/4
A data VLAN is a VLAN that is configured to carry only user-generated traffic. A VLAN could carry voice-based traffic or traffic used to manage the switch, but this traffic would not be part of a data VLAN.
It is common practice to separate voice and management traffic from data traffic.
The importance of separating user data from switch management control data and voice traffic is highlighted by the use of a special term used to identify VLANs that only carry user data - a "data VLAN". A data VLAN is sometimes referred to as a user VLAN.
Fa0/1
Fa0/3
Student
VLAN 20
/24
Student
VLAN 20
/24
Fa0/18
Fa0/18
Fa0/1
Fa0/3
Guest
VLAN 30
/24
Guest
VLAN 30
/24
Fa0/6
Fa0/6

10. VLAN Types
The default VLAN for Cisco switches is VLAN 1. VLAN 1 has all the features of any VLAN, except that it cannot be renamed or deleted. Layer 2 control traffic, such as CDP and spanning tree protocol traffic, will always be associated with VLAN 1 - this cannot be changed.
Management
VLAN 99
/24
It is a security best practice to change the default VLAN to a VLAN other than VLAN 1
Fa0/4
Fa0/1
Fa0/3
All switch ports become a member of the default VLAN after the initial boot up of the switch. Having all the switch ports participate in the default VLAN makes them all part of the same broadcast domain.
This allows any device connected to any switch port to communicate with other devices on other switch ports. The default VLAN for Cisco switches is VLAN 1. VLAN 1 has all the features of any VLAN, except that you cannot rename it and you can not delete it.
Layer 2 control traffic, such as CDP and spanning tree protocol traffic, will always be associated with VLAN 1 - this cannot be changed.
It is a security best practice to change the default VLAN to a VLAN other than VLAN 1; this entails configuring all the ports on the switch to be associated with a default VLAN other than VLAN 1.
Student
VLAN 20
/24
Student
VLAN 20
/24
Fa0/18
Fa0/18
Fa0/1
Fa0/3
Guest
VLAN 30
/24
Guest
VLAN 30
/24
Fa0/6
Fa0/6

11. VLAN Types
A native VLAN is assigned to an 802.1Q trunk port. An 802.1Q trunk port supports traffic coming from many VLANs (tagged traffic) as well as traffic that does not come from a VLAN (untagged traffic).
Trunks are used to allow the same VLAN to span different switches
A native VLAN serves as a common identifier on opposing ends of a trunk link
Management
VLAN 99
/24
Fa0/4
Fa0/1
Fa0/3
A native VLAN is assigned to an 802.1Q trunk port (which are used to allow the same VLAN to span different switches). An 802.1Q trunk port supports traffic coming from many VLANs (tagged traffic) as well as traffic that does not come from a VLAN (untagged traffic).
The 802.1Q trunk port places untagged traffic on the native VLAN. In the figure, the native VLAN is VLAN 99 (the management VLAN). Untagged traffic is generated by a computer attached to a switch port that is configured with the native VLAN.
Native VLANs are set out in the IEEE 802.1Q specification to maintain backward compatibility with untagged traffic common to legacy LAN scenarios.
For our purposes, a native VLAN serves as a common identifier on opposing ends of a trunk link. It is a best practice to use a VLAN other than VLAN 1 as the native VLAN.
Student
VLAN 20
/24
Student
VLAN 20
/24
Fa0/18
Fa0/18
Fa0/1
Fa0/3
Guest
VLAN 30
/24
Guest
VLAN 30
/24
Fa0/6
Fa0/6

12. VLAN Types
A management VLAN is any VLAN configured to access the management capabilities of a switch. VLAN 1 would serve as the management VLAN if you did not proactively define a unique VLAN to serve as the management VLAN.
Default configuration of a Cisco switch has VLAN 1 as the default VLAN - bad choice, as arbitrary users could then attempt to access the switch IOS.
Management
VLAN 99
/24
Fa0/4
Fa0/1
Fa0/3
A management VLAN is any VLAN configured to access the management capabilities of a switch. VLAN 1 would serve as the management VLAN if you did not proactively define a unique VLAN to serve as the management VLAN.
You assign the management VLAN an IP address and subnet mask. A switch can be managed via HTTP, Telnet, SSH, or SNMP.
Since the out-of-the-box configuration of a Cisco switch has VLAN 1 as the default VLAN, this would be a bad choice as the management VLAN; you wouldn't want an arbitrary user connecting to a switch to default to the management VLAN.
Recall that in Chap 2, switch was configured with a management VLAN as VLAN 99.
Student
VLAN 20
/24
Student
VLAN 20
/24
Fa0/18
Fa0/18
Fa0/1
Fa0/3
Guest
VLAN 30
/24
Guest
VLAN 30
/24
Fa0/6
Fa0/6

13. Voice VLAN VoIP traffic requires:
Assured bandwidth to ensure voice quality
Transmission priority over other types of network traffic
Ability to be routed around congested areas on the network
Delay of less than 150 milliseconds (ms) across the network

14. Voice VLAN
The Cisco IP Phone contains an integrated three-port 10/100 switch, providing dedicated connections to:
Port 1 connects to the switch or other voice-over-IP (VoIP) device.
Port 2 is an internal 10/100 interface that carries the IP phone traffic.
Port 3 (access port) connects to a PC or other device.
port on switch is configured to be in voice mode so that it will tell the phone to tag voice frames with voice VLAN ID. Data frames coming through the Cisco IP phone from PC5 are left untagged (not voice).
Data destined for PC5 coming from the switch is tagged with the data VLAN ID on the way to the phone, which strips the VLAN tag before the data is forwarded to PC5.
Tagging refers to the addition of bytes to a field in the data frame which is used by the switch to identify which VLAN the data frame should be sent to.

15. Port Membership Modes - Voice
Configure a switch access port with an attached Cisco IP Phone to use one VLAN for voice traffic and another VLAN for data traffic from a device attached to the phone
Command mls qos trust cos ensures that voice traffic is identified as priority traffic. (note that the entire network must be set up to prioritise voice traffic).
The switchport voice VLAN 150 command identifies VLAN 150 as the voice VLAN.
The switchport access VLAN 20 command configures VLAN 20 as the access mode (data) VLAN.
Voice VLAN - A port is configured to be in voice mode so that it can support an IP phone attached to it. Before you configure a voice VLAN on the port, you need to first configure a VLAN for voice and a VLAN for data.
In the figure, VLAN 150 is the voice VLAN, and VLAN 20 is the data VLAN. It is assumed that the network has been configured to ensure that voice traffic can be transmitted with a priority status over the network.
When a phone is first plugged into a switch port that is in voice mode, the switch port sends messages to the phone providing the phone with the appropriate voice VLAN ID and configuration. The IP phone tags the voice frames with the voice VLAN ID and forwards all voice traffic through the voice VLAN.

16. Port Membership Modes - Static
Static VLAN - Ports on a switch are manually assigned to a VLAN, using the Cisco CLI.
If an interface is assigned to a VLAN that does not exist, the new VLAN is automatically created.

17. Network Traffic
IP telephony traffic consists of signaling traffic and voice traffic. Signaling traffic is, responsible for call setup, progress, and teardown, and traverses the network end to end.
IP multicast traffic is sent from a particular source address to a multicast group that is identified by a single IP and MAC destination-group address pair (e.g. Cisco IP/TV broadcasts).
Normal data traffic is related to file creation and storage, print services, database access, and other shared network applications that are common to business uses.
Scavenger class is intended to provide less-than best-effort services to applications having little or no official purpose - KaZaa, Morpheus, Groekster, Napster, iMesh, Doom, Quake, Unreal Tournament)

18. Connecting VLANs
Breaking up a big broadcast domain into several smaller ones using VLANs reduces broadcast traffic and improves network performance. Breaking up domains into VLANs also allows for better information confidentiality within an organisation.
A router is needed any time devices on different Layer 3 networks need to communicate, regardless whether VLANs are used.
Management
VLAN 99
/24
Fa0/4
Broadcast traffic has been minimised on the network shown, by creating 3 separate VLANs. All broadcast traffic created in VLAN20 is only pseen by devices that are part of VLAN20.
To exchange information between different VLANs, it is necessary to use a router to perform layer 3 switching. In effect, each VLAN uses the router as a default gateway to reach other VLANs.
Fa0/1
Fa0/3
Student
VLAN 20
/24
Student
VLAN 20
/24
Fa0/18
Fa0/18
Fa0/1
Fa0/3
Guest
VLAN 30
/24
Guest
VLAN 30
/24
Fa0/6
Fa0/6

19. Connecting VLANs
Switch Virtual Interface (SVI) is a logical interface configured for a specific VLAN, and is used by layer 3 switches to route between VLANs or to provide IP host connectivity to a switch.
A Layer 3 switch has the ability to route transmissions between VLANs.
The process is the same as when using a separate router, except that the SVIs act as the router interfaces for routing the data between VLANs.
SVI VLAN99
SVI VLAN30
Management
VLAN 99
/24
SVI VLAN20
Layer 3 Switch
Fa0/1
Fa0/3
Student
VLAN 20
/24
Student
VLAN 20
/24
Fa0/18
Fa0/18
Fa0/1
Fa0/3
Guest
VLAN 30
/24
Guest
VLAN 30
/24
Fa0/6
Fa0/6

20. VLAN Trunks
A trunk is a point-to-point link between one or more Ethernet switch interfaces and another networking device, such as a router or a switch. Ethernet trunks carry the traffic of multiple VLANs over a single link.
A VLAN trunk allows extension of VLANs across an entire network. Cisco supports IEEE 802.1Q for coordinating trunks on Fast Ethernet and Gigabit Ethernet interfaces.
A VLAN trunk does not belong to a specific VLAN, rather it is a conduit for VLANs between switches and routers.

21. VLAN Trunking
No VLAN Trunking
VLAN Trunking
In a switched network, a trunk is a point-to-point link that supports several VLANs. The purpose of a trunk is to conserve ports when a link between two devices that implement VLANs is created.
The slide shows two VLANs shared across switches Sa and Sb. Each switch uses two physical links so that each port carries traffic for a single VLAN. This is a simple way to implement inter-switch VLAN communication, but it does not scale well (need many physical interfaces).
The addition of a third VLAN would require the use of two more ports, one on each connected switch. This design is also inefficient in terms of load sharing.
VLAN tagging multiple virtual links over one physical link. This allows the traffic of several VLANs to travel over a single cable between the switches
VLAN Trunking is used when a single link needs to carry traffic for more than one VLAN.

22. 802.1Q Tagging
802.1Q does not encapsulate the original frame, but modifies the Ethernet type field by adding a Tag Control Information (TCI) field.
A TCI contains a 12-bit VLAN identifier (VID), uniquely identifying the VLAN to which the frame belongs (4,096 VLANs max, with 0 and 4095 reserved).
Because inserting this header changes the frame, 802.1Q encapsulation forces a recalculation of the original FCS field in the Ethernet trailer.
802.1Q does not actually encapsulate the original frame. Instead, for Ethernet frames using Ethernet II, it sets the type value in the Ethernet header to hex 8100, identifying this frame as an 802.1Q frame, and then it adds an extra 4 bytes after the Ethernet header, consisting of a two-byte Tag Control Information (TCI) field with:
User Priority: 3-bit field can be used to store a priority level for the frame.
Canonical format indicator (CFI): CFI is used for compatibility between Ethernet and Token Ring networks.
VLAN ID (VID): a 12-bit field specify the VLAN to which the frame belongs.
Because inserting this header changes the frame, 802.1Q encapsulation forces a recalculation of the original FCS field in the Ethernet trailer.

23. Creating VLAN Trumks S1#configure terminal S1(config)#interface F0/1
S1(config-if)#switchport mode trunk
S1(config-if)#switchport trunk native vlan 99
S1(config)#end
Tagged Frames on the Native VLAN - Some devices (e.g. IP phones, servers, routers, and non-Cisco switches) tag native VLAN traffic as a default behavior.
Control traffic sent on the native VLAN should be untagged. If an 802.1Q trunk port receives a tagged frame on the native VLAN, it drops the frame. Consequently, when configuring a switch port on a Cisco switch, you need to identify these devices and configure them so that they do not send tagged frames on the native VLAN.
When a Cisco switch trunk port receives untagged frames it forwards those frames to the native VLAN. The default native VLAN is VLAN 1. When an 802.1Q trunk port is configured, a default Port VLAN ID (PVID) is assigned the value of the native VLAN ID.
All untagged traffic coming in or out of the 802.1Q port is forwarded based on the PVID value. For example, if VLAN 99 is configured as the native VLAN, the PVID is 99 and all untagged traffic is forward to VLAN 99. If the native VLAN has not been reconfigured, the PVID value is set to VLAN 1.

24. Creating VLAN Trumks
Use the show interfaces interface-id switchport command to verify correct reconfiguration of the native VLAN from VLAN 1 to VLAN 99.

25. DTP – Dynamic Trunking Protocol
Dynamic Trunking Protocol (DTP) is a Cisco proprietary protocol.
Switches from other vendors do not support
DTP.
DTP is automatically enabled on a switch port when certain trunking modes are configured on the switch port.

26. DTP Trunking Modes
Switchport Mode Access- permanent non-trunking mode, regardless of neighbouring interface settings.
Switchport Mode Trunk – permanent trunking mode, regardless of neighbouring interface settings.
Switchport Mode Dynamic Desirable – actively tries to convert the port to a trunk if the neighbouring interface is set to trunk, desirable or auto.
Switchport Mode Dynamic Auto – port is willing to convert to a trunk if neighbouring interface is set to trunk or desirable.
Switchport Nonegotiate – port does not generate DTP frames, and must be manually configured.
keep it simple use, either of these commands:
Switch(config-if)switchport mode access or
Switch(config-if)switchport mode trunk

27. Configure VLANs & Trunks
Use the following steps to configure and verify VLANs and
trunks on a switched network:
Create the VLANs
Assign switch ports to VLANs statically
Verify VLAN configuration
Enable trunking on the inter-switch connections
Verify trunk configuration

28. Creating VLANs Creating VLANs Create Named VLAN:
Switch(config)#vlan 10
Switch(config-vlan)#name Engineering
Switch(config-vlan)#exit
In addition to entering a single VLAN ID, you can enter a series of VLAN IDs separated by commas, or a range of VLAN IDs separated by hyphens using the vlan vlan-id command, for example: switch(config)#vlan 100,102,
Verify:
Switch#sh vlan brief

29. Creating VLANs
Assigning access ports to a specific VLAN (10 in this example):
Switch(config)#interface fastethernet 0/9
Switch(config-if)#switchport mode access
Switch(config-if)#switchport access vlan 10
After creating a VLAN, assign one or more ports to the VLAN.
When manually assigning a switch port to a VLAN, it is known as a static access port.
A static access port can belong to only one VLAN at a time.
Note: The switchport mode access command should be configured on all ports that the network administrator does not want to become a trunk port

30. Creating VLANs Switch(config)#interface range fastethernet 0/9 - 12
Switch(config-if)#switchport mode access
Switch(config-if)#switchport access vlan 10
Switch(config-if)#exit
To reassign a port to VLAN 1, use the no switchport access vlan command in interface configuration mode.
When reassigning a static access port to an existing VLAN, the VLAN is automatically removed from the previous port.

31. Managing Ports Fa 0/9 returned to default VLAN
Switch(config)#interface fa 0/9
Switch(config-if)#no switchport access vlan
Switch(config-if)#exit
Fa 0/9 returned to default VLAN

32. Deleting VLANs Delete Named VLAN: Switch(config)#no vlan 10 Fa 0/9-12
Before deleting a VLAN, reassign all member ports to a different VLAN, as they are not returned to the default VLAN, and become inactive
To reassign a port to VLAN 1, use the no switchport access vlan command in interface configuration mode.
When reassigning a static access port to an existing VLAN, the VLAN is automatically removed from the previous port.
Fa 0/9-12
inactive

33. Creating Trunk Switch(config)#interface fa 0/1
VLAN 30
VLAN 20
VLAN 10
VLAN 30
VLAN 20
VLAN 10
Switch(config)#interface fa 0/1
Switch(config-if)#switchport mode trunk
Switch(config-if)#switchport trunk native vlan 99
Switch(config-if)#switchport trunk allowed vlan add 10,20,30
Switch(config-if)#end

34. Switch#show interface fa 0/1 switchport
Verify Trunk
Switch#show interface fa 0/1 switchport

35. Reset Trunk to default settings:
Reset/Delete Trunk
Reset Trunk to default settings:
Delete Trunk:
Switch(config)#interface fa 0/1
Switch(config-if)#switchport mode access

36. VLAN Troubleshooting
Native VLAN mismatches - Trunk ports are configured with different native VLANs. This configuration error generates console notifications, causes control and management traffic to be misdirected.
Trunk mode mismatches - One trunk port is configured with trunk mode "off" and the other with trunk mode "on". This configuration error causes the trunk link to stop working.
VLANS and IP subnets – devices may have been configured with incorrect IP addresses, preventing devices from accessing network resoures.
Allowed VLANs on trunks - The list of allowed VLANs on a trunk has not been updated with the current VLAN trunking requirements. In this situation, unexpected traffic or no traffic is being sent over the trunk.

37. Chap 3 – Virtual LANs (VLANs) Learning Objectives
Explain the role of VLANs in a converged network.
Explain the role of trunking VLANs in a converged network.
Configure VLANs on the switches in a converged network topology.
Troubleshoot the common software or hardware mis-configurations associated with VLANs on switches in a converged network topology.

38. Any
Questions?

39. Chapter 3.5.1 – Basic VLAN Config
Lab Topology
Chapter – Basic VLAN Config S1
PC1
/24
PC4
/24
Fa0/1
Fa0/2
Fa0/11
Fa0/11 S2 S3
Fa0/1
Fa0/2
PC2
/24
Fa0/18
Fa0/18
PC5
/24
Fa0/6
Fa0/6
PC3
/24
PC6
/24
Broadcast traffic has been minimised on the network shown, by creating 3 separate VLANs. All broadcast traffic created in VLAN20 is only pseen by devices that are part of VLAN20.
To exchange information between different VLANs, it is necessary to use a router to perform layer 3 switching. In effect, each VLAN uses the router as a default gateway to reach other VLANs.