{"id":1856,"date":"2016-08-27T08:43:23","date_gmt":"2016-08-27T13:43:23","guid":{"rendered":"http:\/\/swildow.darktech.org\/wp\/?p=1856"},"modified":"2016-08-27T08:43:23","modified_gmt":"2016-08-27T13:43:23","slug":"virtual-local-area-networks-vlans","status":"publish","type":"post","link":"http:\/\/www.wildow.com\/blog\/?p=1856","title":{"rendered":"Virtual Local Area Networks (VLANs)"},"content":{"rendered":"

Virtual Local Area Networks (VLANs)<\/a><\/h1>\n
JUNE 23, 2016<\/span> by ed harmoush<\/a><\/span><\/span> 4 comments<\/a><\/span><\/div>\n
\n

Virtual Local Area Networks, or VLANs<\/strong>, are a very simple concept that has been very poorly defined by the industry.<\/p>\n

This article will explain VLANs from a practical<\/em> perspective. It will be framed around the two major functions of VLANs, and then concluded with another equally poorly defined concept, the Native VLAN.<\/p>\n

Finally, at the end of the article is a two question comprehension challenge \u2013 if you can successfully answer these two questions, then you can consider yourself to fully understand the concept<\/em> of VLANs \u2014 the topic of configuring VLANs<\/a>will be covered in another article.<\/p>\n

 <\/p>\n

Two Major\u00a0Functions of VLANs<\/h3>\n

Below is a network with three different physical switches. The switches facilitate communication within networks<\/a>, and the Routers facilitate communication between networks<\/a>.<\/p>\n

\"vlans-3sw\"<\/a><\/p>\n

Each switch above independently performs the four functions of switch<\/a>.<\/p>\n

If each of these switches have\u00a024 ports and only two are in use, then 22 ports are left wasted on each switch. Moreover, what if you need to replicate this network elsewhere and you do not have three physical switches to accommodate?<\/p>\n

That is where the first major function of a VLAN comes into play: A VLAN allows you to take one physical switch, and break it up into smaller mini-switches<\/em><\/strong>.<\/p>\n

Breaking up one Physical Switch into multiple Virtual Switches<\/h5>\n

Consider each circle on the switch below as its own mini-switch<\/em>. Each of these mini-switches<\/em>, or virtual<\/em> switches, operate completely independent from the others\u00a0\u2014 exactly as they would had there been three different physical switches.<\/p>\n

\"vlans-1sw-3vlan\"<\/a><\/p>\n

Traffic flow through this topology operates\u00a0exactly as it did in the topology above it (with three separate physical switches).<\/p>\n

Each virtual\u00a0<\/em>switch, or VLAN<\/em>, is simply a number assigned to each switch port<\/strong>. For example, the two switch ports in the red mini-switch<\/em> might be assigned to VLAN #10<\/code>. The two ports in the orange mini-switch<\/em> might be assigned to VLAN #20<\/code>. And lastly the two switch ports in the blue mini-switch<\/em> might be assigned to VLAN #30<\/code>.<\/p>\n

If a port is not explicitly assigned a VLAN number, it resides in the default VLAN, which has a VLAN number of 1<\/code>.<\/strong><\/p>\n

Traffic arriving on a switch port assigned to VLAN #10<\/code> will only ever be forwarded out another switch port that belongs to VLAN #10<\/code> \u2013 a switch will never allow traffic to cross a VLAN boundary<\/strong>. Again, each VLAN operates as if it were a completely separate physical switch.<\/p>\n

In the first illustration, traffic from the red switch cannot magically appear on the orange switch without first passing through a router. Similarly, in the second illustration, traffic in VLAN #10<\/code> cannot magically appear on VLAN #20<\/code> without also passing through a router.<\/p>\n

Each of the VLANs also maintain their own, independent, MAC address table<\/a>. If Host A sends a frame with a destination MAC address of Host B, that frame would still be flooded solely within the switch ports in VLAN #10<\/code>.<\/p>\n

Ultimately, assigning different ports to different VLANs allows you to re-use a single physical switch for multiple purposes. This is the first major\u00a0function of a VLAN.<\/p>\n

But that isn\u2019t all VLANs allow you to do.\u00a0The\u00a0second major\u00a0function is VLANs allow you to extend the smaller Virtual switches across multiple Physical switches<\/strong>.<\/p>\n

Extending Virtual Switches across multiple Physical Switches<\/h5>\n

To illustrate this point, we will expand the topology above with an additional physical switch and two additional hosts:<\/p>\n

\"vlans-2sw-3vlan\"<\/a><\/p>\n

Notice how a VLAN# 10 and VLAN# 30 have been extended onto a second switch. This enables Host A and Host C to exist in the same VLAN, despite being connected to different physical switches located in potentially different areas.<\/p>\n

The primary benefit of extending a VLAN to different physical switches is that the\u00a0Layer 2 topology\u00a0no longer has to be tied to the\u00a0Physical Topology. A single VLAN can span across multiple rooms, floors, or office buildings.<\/p>\n

Each connected switch port in the topology above is a member of only a single VLAN. This is referred to as an\u00a0Access<\/strong>port. An Access port is a switch port that\u00a0is a member of only one<\/em> VLAN<\/strong>.<\/p>\n

Whenever the switch receives any traffic on an Access port, it accepts the traffic onto the configured VLAN.<\/p>\n

In order to extend a VLAN to the second switch, a connection is made between one<\/em>\u00a0Access port on both<\/em> switches foreach<\/em> VLAN.\u00a0While functional, this strategy does not scale. Imagine if our topology was using ten VLANs, on a 24 port switch nearly half of the ports would be taken up by the inter-switch links.<\/p>\n

Instead, there is a mechanism which allows a single switch port to carry traffic from multiple VLANs. This is referred to as a Trunk<\/strong> port. A Trunk port is a switch port that\u00a0carries traffic for multiple<\/em> VLANs<\/strong>.<\/p>\n

\"vlans-trunks-and-access\"<\/a>We can use Trunk ports to reduce the amount of switch ports required for the topology above. This enables us to leave more ports available to add hosts to the network in the future.<\/p>\n

This physical topology operates (logically) identically to the illustration above it, but requires far fewer switch ports.<\/p>\n

We were able to use a total of four Trunk ports (across both switches) to replace eight different Access ports in the prior illustration.<\/p>\n

Typically, switch ports connected to end-host devices are configured as Access ports<\/strong>\u00a0(e.g., workstations, printers, servers). Conversely,\u00a0switch ports connected to other network devices are configured as Trunk ports<\/strong>\u00a0(e.g., other switches, routers). We will uncover the reason for this later in this article.<\/p>\n

 <\/p>\n

Tagged Ports and Untagged Ports<\/h3>\n

A Trunk port on a switch can receive traffic for more than one VLAN. For example, in the illustration above, the link between the two switches is carrying traffic for both VLAN 10 and VLAN 30.<\/p>\n

But in both cases, the traffic is leaving one switch as a series of 1s and 0s, and arriving on the other switch as a series of 1s and 0s. Which begs the question, how will the receiving switch determine which 1s and 0s belong to VLAN #10<\/code>, and which 1s and 0s belong to VLAN #30<\/code>?<\/p>\n

To account for this, whenever a Switch is forwarding traffic out a Trunk port, it adds to that traffic a\u00a0tag<\/em> to indicate to the other end what VLAN that traffic belongs to<\/strong>. This allows the receiving switch\u00a0to read the VLAN tag in order to determine what VLAN the incoming traffic should be associated to.<\/p>\n

An Access<\/em> port, by comparison, can only ever carry or receive traffic for a single VLAN. Therefore, there is no need to add a VLAN Tag to traffic leaving an Access port<\/strong>.<\/p>\n

\"vlans-ethernet-dot1q-tag\"<\/a>Since VLANs are a Layer 2 technology, the VLAN Tag is inserted within the Layer 2 header. The standard Layer 2 header in modern networks is the Ethernet<\/a> header, which has three fields: Destination MAC Address<\/em>, Source MAC Address<\/em>, and Type<\/em>.<\/p>\n

When an Ethernet frame is exiting a Trunk port, the switch will insert a VLAN Tag between the Source MAC address<\/em> and the Type<\/em> fields.<\/p>\n

This allows the receiving switch to associate the frame with the appropriate VLAN.<\/p>\n

 <\/p>\n

To summarize, the final topology with traffic traveling between Host C and Host D through Access ports and Trunk ports will look like this:<\/p>\n

\"vlans-3vlans-tag-untag\"<\/a><\/p>\n

The physical topology above will work\u00a0exactly like the logical topology below. The hosts will not know whether they are going through two physical switches (or three or four), or what VLANs they are in. They operate exactly as they would in any situation which involves moving packets through a network<\/a>.<\/p>\n

\"vlans-logical-2\"<\/a><\/p>\n

 <\/p>\n

Access Ports and End-Host Devices<\/h5>\n

Earlier we mentioned Access ports typically face end-host devices like workstations or printers or servers. Part of the reason for this is that switches do not add a VLAN tag when sending traffic out an Access port.<\/p>\n

Most end-host devices do not understand the concepts of VLANs<\/strong>. In fact, if they received frames with a VLAN tag inserted in the middle of the Ethernet header, they are likely to drop them<\/strong>\u00a0under\u00a0the assumption that they were malformed frames.<\/p>\n

Of course, understanding the concepts of VLANs is merely a matter of installing the right software or software patch,\u00a0but imagine the overhead of requiring every user on your network to both install the software patch, and configure their devices to send the appropriate VLAN tag.<\/p>\n

It is much better for the network administrator to configure and concern themselves with\u00a0VLANs, and for the end-host devices to remain blissfully ignorant of what VLAN they are in, or even whether VLANs are being utilized at all.<\/p>\n

Terminology<\/h5>\n

Finally, a quick note on terminology. The terms Access port and Trunk port are usually associated with the Cisco world. But VLANs are an open standard, therefore other vendors are able to implement VLANs as well.<\/p>\n

What Cisco calls a Trunk port (i.e., a switch port that carries traffic for more than one VLAN), other vendors refer to as a Tagged<\/strong> port \u2013 referring to the addition of a VLAN tag to all traffic leaving such a port.<\/p>\n

What Cisco calls an Access port (i.e., a switch port that carries traffic for only one VLAN), other vendors refer to as anUntagged<\/strong> port \u2013 referring to the traffic leaving the switch port without a VLAN tag.<\/p>\n

These terms are not exhaustive, there are some vendors that may yet use other terminology, other vendors may even mix and match these terms. Regardless of the terminology used, all the concepts discussed above \u00a0still apply.<\/p>\n

 <\/p>\n

 <\/p>\n

802.1q VLAN Tag<\/h3>\n

VLAN tags requires adding and removing bits to Ethernet frames.\u00a0The specific sequence of bits to add is governed by an open standard, which allow any vendor to implement VLANs on their devices.<\/p>\n

The exact format of the VLAN Tag is governed by the 802.1q standard<\/strong>. This is an open, IEEE standard which is the ubiquitous method of VLAN tagging in use today.<\/p>\n

To demonstrate exactly how the VLAN Tag modifies a packet, take a look at the packet capture below of the same frame before and after it exits a Trunk port.<\/p>\n

\"vlan-dot1q-tag\"<\/a><\/p>\n

The portion of the frame highlighted in yellow is the added\u00a0VLAN tag. Notice it is inserted between the Source MAC address<\/em>\u00a0and Type<\/em> field of the original Ethernet header.<\/p>\n

You can view\u00a0this capture yourself in Cloudshark<\/a>, or you can download the capture file<\/a> and open it in Wireshark<\/a>.<\/p>\n

No other modification to the frame or its payload is made by the addition or removal of the VLAN tag. That said, since even the slight modification displayed above is made, adding and removing the VLAN tag also involves recalculating the CRC<\/a> \u2014 which is a simple hash algorithm<\/a> devised to detect transmissions errors on the wire.<\/p>\n

 <\/p>\n

There is an older method of VLAN tagging which is\u00a0a closed, Cisco proprietary method. This method was called Inter-Switch Link<\/a>, or ISL<\/strong>. ISL fully encapsulated<\/a> the L2 frame in a new header which included the VLAN identification number.<\/p>\n

But these days, even newer Cisco products do not support ISL, as the entire industry has moved to the superior, open standard of 802.1q.<\/p>\n

 <\/p>\n

 <\/p>\n

Native VLAN<\/h3>\n

There is one final concept associated with VLANs that often brings confusion. That is the concept of the Native VLAN<\/strong>.<\/p>\n

The Native VLAN is the answer to how a switch processes traffic it receives on a Trunk port which does not contain a VLAN Tag<\/strong>.<\/p>\n

Without the tag, the switch will not know what VLAN the traffic belongs to, therefore the switch associates the untagged traffic with what is configured as the Native VLAN. Essentially, the Native VLAN is the VLAN that any received untagged traffic gets assigned\u00a0to on a Trunk port<\/strong>.<\/p>\n

Additionally, any traffic the switch forwards out a Trunk port that is associated with the Native VLAN is forwardedwithout<\/em> a VLAN Tag.<\/p>\n

The Native VLAN can be configured\u00a0on any Trunk port. If the Native VLAN is not explicitly designated on a Trunk port, the default configuration of VLAN #1<\/code> is used.<\/p>\n

That being said, it is crucially important that both sides of a Trunk port are configured with the same Native VLAN. This illustration explains why:<\/p>\n

\"vlan-native-mismatch\"<\/a><\/p>\n

Above we have four Hosts (A, B, C, D) all connected to Access Ports in VLAN #22<\/code> or VLAN #33<\/code>, and Switch X and Switch Y connected to each other with a Trunk port.<\/p>\n

Host A is attempting to send a frame to Host C. When it arrives on the switch, Switch X associates the traffic with\u00a0VLAN #22<\/code>. When the frame is forwarded out Switch X\u2019s Trunk port, no tag is added since the Native VLAN for the Trunk Port on Switch X is also VLAN #22<\/code>.<\/p>\n

But when the frame arrives on Switch Y without a tag, Switch Y has no way of knowing the traffic should belong toVLAN #22<\/code>. All it can do is associated the untagged traffic with what Switch Y\u2019s Trunk port has configured as the Native VLAN, which in the case is VLAN #33<\/code>.<\/p>\n

Since Switch Y will never allow VLAN #33<\/code> traffic to exit a VLAN #22<\/code> port, Host C will never get this traffic. Even worse, due to a Switch\u2019s flooding<\/a> behavior, Host D might inadvertently get the traffic that was destined to Host C.<\/p>\n

 <\/p>\n

Finally, it should be noted that the Native VLAN is an 802.1q feature. The antiquated tagging mechanism of ISL simply dropped traffic receive on a Trunk port that did not include the ISL tag. Also, remember that the Native VLAN concept only applies to Trunk ports<\/strong> \u2014 traffic leaving and arriving on an Access port is always expected to be untagged.<\/p>\n

 <\/p>\n

VLAN Comprehension\u00a0Challenge<\/h3>\n

To test yourself to see if you fully understand how VLANs work, there is a simple challenge we can offer.<\/p>\n

Below is a (poorly) configured topology, featuring five switches and twelve hosts. Each switch port is configured as either an Access port in the displayed VLAN, or a Trunk Port with the Native VLAN displayed.<\/p>\n

The challenge is to answer just these two simple questions:<\/p>\n

\n
\n
\n

\"vlan-game\"<\/a><\/p>\n<\/div>\n<\/div>\n

\n
\n

Question #1:<\/strong> If Host A sends a frame to Host B, will Host B receive it?<\/p>\n

Question #2:<\/strong> If Host A sends a Broadcast, which hosts will receive it?<\/p>\n

The answers and an explanation are provided below.<\/p>\n

Remember, the goal isn\u2019t simply to get the answer right, but to be able to understand\u00a0why<\/em>. If you can explain the answers to both of these questions to someone else, then you know you will have mastered the concept of VLANs.<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n","protected":false},"excerpt":{"rendered":"

Virtual Local Area Networks (VLANs) JUNE 23, 2016 by ed harmoush 4 comments Virtual Local Area Networks, or VLANs, are a very simple concept that has been very poorly defined by the industry. This article will explain VLANs from a … Read More »<\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-1856","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"_links":{"self":[{"href":"http:\/\/www.wildow.com\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1856","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/www.wildow.com\/blog\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/www.wildow.com\/blog\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/www.wildow.com\/blog\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/www.wildow.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1856"}],"version-history":[{"count":1,"href":"http:\/\/www.wildow.com\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1856\/revisions"}],"predecessor-version":[{"id":1857,"href":"http:\/\/www.wildow.com\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1856\/revisions\/1857"}],"wp:attachment":[{"href":"http:\/\/www.wildow.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1856"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/www.wildow.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1856"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/www.wildow.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1856"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}