Chapter 11 – Implementing Ethernet Virtual LANs

Virtual LAN Concepts

  • LAN includes all the user devices, servers, switches, routers, cables, and wireless access points in one location 
  • Better formula for LAN would be – LAN includes all devices in the same broadcast domain 
  • LAN and broadcast domain are basically the same thing when we talk about packet forwarding 
  • Without VLAN, switch considers all its interfaces to be in the same broadcast domain 
  • Meaning that when broadcast frame enters one switch’s port, it will forward it to all other ports. 
  • With VLANs, switch can configure some interfaces into one broadcast domain, and some into another, creating multiple broadcast domains. 
  • These individual broadcast domains created by switch are called VLANs 
Key 
Topic 
Broadcast 
Domain 1 
(VLAN 1) 
Subnet 1 
Dino 
Fred 
51 
Broadcast 
Domain 2 
(VLAN 2) 
Subnet 2 
Figure 11-2 Creating Two Broadcast Domains Using One Switch and VLANs

The following list explains why to choose VLAN and creating smaller broadcast domains (VLANs)

  • to reduce CPU overhead on each device by reducing the number of devices that receive a broadcast frame 
  • to reduce security risks by reducing the number of hosts that receive copies of frames 
  • to improve security for hosts that send sensitive data by keeping those hosts on separate VLAN 
  • to create more flexible designs that group users by department, by groups, by physical location 
  • to solve problems more quickly 
  • to reduce workload for the Spanning Tree Protocol by limiting a VLAN to a single access switch. 

Creating multi-switch VLANs using trunking

fiïl ciii 
fi31 [i@l 
SWI 
VLAN 10 
Link is in VLAN 10 
Link is in VLAN 20 
SW2 
Figure 1 1-3 
VLAN 20 
Multiswitch VLAN Without VLAN Trunking
  • VLAN trunking creates one link between each switch that supports as many VLANs as you need.  
  • As a VLAN trunk, the switches treat the link as if it were a part of all the VLANs 
  • The trunk keeps the VLAN traffic separate, so frames in VLAN10 would not go to devices in VLAN20 and vice versa  
  • To do so, frames need to be identified by VLAN number as it crosses the trunk.  
  • The uses of trunking allows switches to pass frames from multiple VLANs over a single physical connection by adding a small header to the Ethernet frame. 
VLAN 10 
20 
20 
10 
ITI Cl 
20 
SW2 
SWI 
Figure 11-4 
VLAN 20 
Multiswitch VLAN with Trunking
VLAN 10 
VLAN 10 
Ethernet 
0/1 V 
swi 
0/3 0/4 
VLAN 20 
1 
GO/I 
VLAN 10 Ethernet 
0/1 
0/2 
Ethernet 
GO/2 
20 
SW2 
0/3 0/4 
VLAN 20 
Figure 11-5 V LAN Trunking Between Two Switches
  • In the example above, PC 11 sends a broadcast frame, and because there is VLAN10 on SW2, SW1 will create VLANID of 10, and stick it to the Ethernet frame and send to SW2 
  • SW2 knows that this frame is for VLAN10 and therefore broadcasts the frame to all VLAN10 ports 

The 802.1Q and ISL VLAN trunking protocols

  • Cisco supported two different trunking protocols over the years: 
    • Inter-Switch Link (ISL) 
    • IEEE 802.1Q 
  • Cisco created the ISL long before 802.1Q because the IEEE had not yet defined a VLAN trunking standard 
  • ISL was beaten by 802.1Q because it is more popular 
  • The ISL and 802.1Q are doing the same thing, tagging each frame with VLAN ID, the details differ 
  • 802.1Q inserts an extra 4 byte 802.1Q VLAN header into the original Ethernet frame header. 
  • Cisco switches break the range of VLAN IDs (1-4094) into two ranges: 
  • Normal range (1-1005) 
  • Extended range (1006-4094) (some switches) 
  • 802.1Q defines one special VLAN ID on each trunk as the native VLAN (defaulting to VLAN1) 
  • 802.1Q does not add the header to frames in the native VLAN 
  • When the switch receives a frame that does not have 802.1Q header, it assumes it is for VLAN1 (native VLAN) 
  • Both switches must agree on which VLAN is native VLAN 
Dest. Address 
802.1 Q 
Tag 
Source Address 
Type 
Type 
Data 
VLAN ID (12 Bits) 
FCS

Forwarding data between VLANs

Routing packets between VLANs with a router: 

  • When including VLANs in a campus LAN design, the devices in a VLAN need to be in the same subnet. 
  • Devices in different VLANs need to be in different subnets. 
VLAN 10 
Subnet 10 
Dino 
Fred 
51 
51 
Wilma 
VLAN 20 
Subnet 20 
Figure 11-7 Layer 2 Switch Does Not Route Between the VLANs
  • In this example, DINO cannot communicate with WILMA because this switch is layer 2 switch and VLANs cannot communicate 
  • The layer 2 logic does not let the layer 2 switch forward the Ethernet frame between VLANs 
  • However, routers can route layer 3 packets between subnets as their normal job in their miserable life 
  • For example, the image below shows a router that can route packets between subnets 10 and 20 
VLAN 10 
Subnet 10 
Dino 
Fred 
D, Wilma 
VLAN 20 
Subnet 20 
FO/O 
FO/I 
Figure 1 1-8 
RI 
Routing Between Two V LANs on Two Physical Interfaces
  • The image above shows a router that can route packets between subnets 10 and 20.  
  • The image shows the same layer 2 switch with two VLANs that separate switch, and with the same PCs in the same VLAN and subnets.  
  • Now, R1 has one LAN interface connected to VLAN1 and other to VLAN 20 
  • With an interface connected to each subnet, the layer 2 switch can keep doing its job forwarding frames inside a VLAN, 
  • While the router can do its job, routing IP packets between two subnets 
  • The topology above works but it uses too many ports and interfaces 
  • To replace this topology, we can use trunking as a method of forwarding 
  • Trunking can work between any two devices that choose to support it: 
    • between two switches 
    • between a router and a switch 
    • between server hardware and a switch 
VLAN 10 
Subnet 10 
VLAN 20 
Subnet 20 
Dino 
Fred 
Wilma 
Betty 
SWI 
1 
FO/O 
RI 
2 
Figure 11-9 
Routing Between Two V LANs Using a Trunk on the Router

BECAUSE THE ROUTER HAS A SINGLE PHYSICAL LINK CONNECTED TO A LAN SWITCH, THIS DESIGN IS CALLED ROUTER ON A STICK 

Routing packets with a layer 3 switch

  • Layer 3 switches (multilayer switches) 
  • Layer 3 switch can be configured to act as layer 2 switch or layer 2 switching and layer 3 routing 
  • Many medium to large-sized enterprise campus LANs use layer 3 switches to route packets between subnets in a campus 
VLAN 10 
Subnet 10 
Dino 
Fred 
Layer 3 Switch 
(All Functions in Middle Box) 
Layer 2 Switch 
VLAN 20 
Subnet 20 
Wilma 
, Betty 
Interface 
VLAN 10 
Interface 
VLAN 20 
Figure 11-10 
Layer 3 Router 
Multilayer Switch: Layer 2 Switching with Layer 3 Routing in One Device

VLAN and VLAN trunking configuration and verification: 

  • Creating VLANs and assigning access VLANs to an interface 
  • Configuring interfaces that do use VLAN trunking 

Creating VLANs and assigning access VLANs to an interface: 

  • section shows how to create VLAN, give it a name, assign interfaces to VLAN 

CONFIGURATION CHECKLIST: 

  1. from configuration mode, use # vlan <vlan_id> command to create and to move the user into VLAN configuration mode 
  2. use # name <name> command in VLAN config mode to list a name for the VLAN 

For each access interface follow these steps: 

  1. # interface <type number>  move into interface (interface fa 0/1 for example) 
  2. # switchport access vlan <id-number>  specify the VLAN number associated with the interface 
  3. # switchport mode access  make that port as access port and NOT trunk port. 

VLAN CONFIGURATION EXAMPLE 1:  

VLAN 2 
VLAN 1 
Figure 11-11 
FaO/13 
FaO/12 
FaO/11 
SWI 
Fa0/14 
Fa0/15 
FaO/16 
VLAN 3 
Network with One Switch and Three VLANs
SW1# show vlan brief 
SW1# configure terminal  
SW1(config)# name <vlan_name> 
SW1(config-vlan)# exit 
SW1(config)# interface range fastethernet 0/13 - 14 
SW1(config-if)# switchport access vlan 2 
SW1(config-if)# switchport mode access 
SW1(config-if)# end 

Checking done work: 

SW1# show vlan brief 
SW1# show running-config 
SW1# show vlan id 2 

VLAN Trunking protocol

  • VLAN Trunking Protocol (VTP) 
  • VTP is Cisco proprietary tool on Cisco switches that advertises each VLAN configured in one switch so that all other switches in LAN learn about that VLAN 
  • Check VTP status with show vtp status command. If the switch uses VTP server or client mode, you will find: 
  • Server switches can configure VLANs in the standard range only (1-1005) 
  • Client switches cannot configure VLANs 
  • Both servers and clients may be learning new VLANs from other switches, and seeing their VLANs deleted by other switches, because of VTP 
  • Show running-config command does not list any VLAN commands 

In lab switch to VTP transparent mode and ignore VTP until ICND2 

VLAN trunking configuration

  • Trunking can be simple if you just statically configure trunking 
  • Trunking configuration on Cisco switches has many options, including several options for dynamically negotiating various trunking settings. 
  • Cisco switches that support ISL and 802.1Q can negotiate which type to use, using the Dynamic Trunking Protocol (DTP) 
  • If both switches support both protocols, they use ISL, otherwise they use the protocol that both support. 
  • Today, many switches do not support the ISL trunking protocol 

802.1Q Dominates.

  • Switches that support both types of trunking use switch port trunk encapsulation (dot1q, isl, negotiate) interface subcommand to either configure the type or allow DTP to negotiate the type 
  • DTP can also negotiate whether the two devices on the link agree to trunk at all 
  • Cisco switches use switch port mode interface subcommand to define the administrative trunking mode 
Table 11-2 Trunking Administrative Mode Options with the switchport mode Command 
Command Option 
access 
trunk 
dynamic desirable 
dynamic auto 
Description 
Always act as an access (nontrunk) port 
Always act as a trunk port 
Initiates negotiation messages and responds to negotiation messages to 
dynamically choose whether to start using trunking 
Passively waits to receive trunk negotiation messages, at which point 
the switch will respond and negotiate whether to use trunking
VLAN 2 
VLAN 1 
Figure 11-12 
aO/13 
SWI 
FaO/l 
VLAN 3 
FaO/12 
FaO/11 
FaO/22 
FaO/21 
GiO/1 
Trunk 
GiO/2 
SW2 
FaO/15 
FaO/16 
FaO/23 
FaO/24 
Network with Two Switches and Three VLANs
  • The example above, switches use gigabit trunk link.  
  • In this case, the trunk does not dynamically form by default because both switches default to an administrative mode of dynamic auto, meaning that neither switch initiates the trunk negotiation process 
  • By changing one switch to use dynamic desirable mode, which does initiate the negotiation, the switches will negotiate to use trunking, specifically 802.1Q because the 2960 supports only that trunking protocol 
#show interfaces trunk - to verify whether trunking is working now 
Table 11-3 Expected Trunking Operational Mode Based on the Configured 
Administrative Modes 
Administrative Mode Access 
Dynamic Auto Trunk 
access 
dynamic auto 
trunk 
dynamic desirable 
Access 
Access 
Access 
Access 
Do Not Usel Trunk 
Access 
Trunk 
Do Not Use 
Trunk 
Trunk 
Trunk 
Dynamic Desirable 
Access 
Trunk 
Trunk 
Trunk 
I When two switches configure a mode of "access" on one end and "trunk" on the other, problems occur. 
Avoid this combination.
  • Cisco recommends disabling trunk negotiation on most ports for better security 
  • The majority of switch ports on most switches will be used to connect to users 
  • As a matter of habit, you can disable DTP negotiations using the switchport nonegotiate interface subcomand 

Implementing interfaces connected to phones: 

User's Desk 
Telephone UTP 
Ethernet UTP 
Closet 
Voice 
Switch 
Ethernet 
Switch 
Figure 11-13 Before IP Telephony: PC and Phone, One Cable Each, Connect ro Two 
Different Devices

Data and voice VLAN concepts

  • Cisco embedded small three-port switches into each phone 
  • IP telephones have small LAN switch 
User's Desk 
PC 
Phone 
Ethernet UTP 
Wiring Closet 
Ethemet 
Switch 
Patch Embedded 
Cable Switch 
Figure 1 1-14 Cabling with an IP Phone, a Single Cable, and an Inregrared Switch

Configuring the Voice and Data VLAN on ports connected to phones:

SW1# configure terminal
SW1(config)# vlan 10
SW1(config-vlan)# vlan 11
SW1(config-vlan)# interface range FastEthernet0/1 - 4
SW1(config-if)# switchport mode access
SW1(config-if)# switchport access vlan 10
SW1(config-if)# switchport voice vlan 11
SW1(config-if)# ^Z
SW1#
Table 11-6 
Command 
vlan vlan-id 
Chapter 1 1 Configuration Command Reference 
name vlan-name 
[no] shutdown 
[no] shutdown vlan vlan-id 
vtp mode {server I client I transparent 
I off) 
switchport mode {access I dynamic 
{auto I desirable) I trunk} 
switchport access vlan vlan-id 
switchport trunk encapsulation {dotlq I 
isl I negotiate) 
switchport trunk native vlan vlan-id 
switchport nonegotiate 
Description 
Global config command that both creates the 
VLAN and puts the CLI into VLAN configuration 
mode 
V LAN subcommand that names the VLAN 
V LAN mode subcommand that enables (no 
shutdown) or disables (shutdown) the VLAN 
Global config command that has the same effect as 
the [nol shutdown VLAN mode subcommands 
Global config command that defines the VTP mode 
Interface subcommand that configures the trunking 
administrative mode on the interface 
Interface subcommand that statically configures the 
interface into that one VLAN 
Interface subcommand that defines which type 
of trunking to use, assuming that trunking is 
configured or negotiated 
Interface subcommand that defines the native 
V LAN for a trunk port 
Interface subcommand that disables the negotiation 
of VLAN trunking
Command 
switchport voice vlan vlan-id 
switchport trunk allowed vlan {add I all 
I except I remove} vlan-list 
Description 
Interface subcommand that defines the voice 
VLAN on a port, meaning that the switch uses 
802.1Q tagging for frames in this VLAN 
Interface subcommand that defines the list of 
allowed VLANs
Table 11-7 Chapter Il EXEC Command Reference 
Command 
show interfaces interface-id 
switchport 
show interfaces interface-id trunk 
show vlan [brief I id vlan-id I name 
vlan-name I summary] 
show vlan [vlanl 
show vtp status 
Description 
Lists information about any interface regarding 
administrative settings and operational state 
Lists information about all operational trunks (but no 
other interfaces), including the list of VLANs that can 
be forwarded over the trunk 
Lists information about the V LAN 
Displays VLAN information 
Lists VT P configuration and status information

This Post Has 2 Comments

  1. random

    Very nice article, totally what I needed.

  2. somebody

    Hi there, just became alert to your blog through Google, and found that it’s really informative.
    I am going to watch out for brussels. I will appreciate if you continue this in future.
    Lots of people will be benefited from your writing.

    Cheers!

Leave a Reply