Understanding VLAN Basics and Types
Understanding VLAN Basics and Types
01 Introduction 03
02 Broadcast Domain 04
03 VLAN Basic 05
04 VLAN Types 06-07
05 VLAN Ranges 08
06 Switchport Modes 09
12 IEEE 802.1Q 23
13 Native VLAN 24-28
Introduction
VLANs are a fundamental technology in modern networking, allowing administrators to logically divide a physical network into multiple,
isolated broadcast domains. Devices in different VLANs cannot communicate with each other directly, unless they are routed
through a router or switch. Virtual local area networks (VLANs) were first conceived in the late 1980s by W. David Sincoskie, a computer
engineer at Bellcore. Sincoskie was looking for a way to improve the performance and security of Ethernet networks, which were
becoming increasingly congested as more devices were connected to them. Sincoskie's early work on VLANs was implemented using a
bridging protocol called GARP (Generic Attribute Registration Protocol). GARP allowed switches to communicate with each other and
dynamically assign devices to VLANs.
In 1998, the IEEE 802.1Q standard was published, which defined a standard way to implement VLANs in Ethernet networks. The 802.1Q
standard added a new header to Ethernet frames that allows switches to identify the VLAN that a frame belongs to. Today, VLANs are
an essential part of many enterprise networks. They are used to improve performance, security, and manageability. VLANs are also being
used in new and innovative ways, such as in cloud computing and software-defined networking.
Inter-Switch Link (ISL) is a cisco proprietary VLAN trunking protocol developed by Cisco Systems in the 1990s. ISL played a significant
role in the early days of Virtual Local Area Networks (VLANs) before the IEEE 802.1Q standard became widely adopted.
Broadcast Domain
LAN: A Local Area Network (LAN) is a single broadcast domain, including all devices in that broadcast domain. In another word, LAN is a
single network where various end devices communicates through MAC Address (Layer 2) without any routing (Layer 3).
Broadcast Domain: A broadcast domain is the group of devices which will receive a broadcast frame (destination MAC [Link])
sent by any one of the members.
• Switches broadcast ethernet frames if they haven’t learned the destination MAC address.
• Switches flood broadcast traffic on all their interfaces, except the one they received the broadcast on.
• Size of the broadcast domain depends on number of devices connected in LAN/VLAN.
• Routers do not forward broadcast traffic, they break broadcast domains. But VLANs on switches also break the broadcast domain.
No Broadcast
VLAN Basics
VLAN: VLAN is a logical grouping of devices on a network that are treated as if they were on a separate physical network, even though they
may be connected to the same switch or router.
• VLANs are configured on switches on a per-interface basis and it logically separate end hosts at layer 2.
• Reduces broadcast domain in a LAN.
• Switches do not forward traffic directly between hosts in different VLANs.
• VLANs limit the number of broadcast, better performance and enhance network security.
• Improves the network performance and reduces network congestion.
Every interfaces in a switch maintain a MAC-Address-Table to forward frames in Layer 2 communication. This table has four columns-
• VLAN: VLAN ID if used.
• MAC-Address: Connected or received end host’s MAC addresses.
• Type: Static or Dynamic
• Port: Port on which the destination device is connected.
***Every Interfaces in Switch/Router has a Network Interface Card (NIC) and a unique MAC Address.
***End host cannot understand VLAN information. Connected interfaces of the switch belongs to specific VLANs.
VLAN Types
There are mainly five types of VLAN-
1. Default VLAN: It is the VLAN that is by default exist. In different vendor switches like Cisco, HP, Huawei, etc, the default VLAN is
typically 1. At the initial boot up of the switch, all the ports become a member of the default VLAN (one broadcast domain). VLAN 1 has
all the features of any VLAN, except it cannot be renamed or deleted. It is commonly used for traffic that has not been explicitly tagged
with a VLAN ID.
2. Data VLAN: It is the most common type of VLAN, also known as a user VLAN. The link connected to end devices like PC is assigned
to a data VLAN. It is designed only for user-generated data such as regular network traffic. Data VLANs can help to improve network
performance and security by isolating different groups of traffic from each other.
3. Voice VLAN: Voice VLANs are used to carry voice over IP (VoIP) traffic, also known as Auxiliary VLAN (AUX VLAN). Voice VLAN
enables access ports to carry IP voice traffic from an IP Phone. VoIP traffic is time-sensitive, so it is important to isolate it from other
types of traffic to avoid performance problems. Voice VLANs can also help to improve the quality of VoIP calls by reducing jitter and
latency. IP Phones used the same UTP cables to connect to ethernet switch. PCs will be in a data VLAN and IP Phones will be in the
Voice VLAN.
VLAN Types
4. Management VLAN: Management VLANs are used to group together devices that need to be managed, such as switches, routers,
and firewalls including remote administration, device monitoring and configuring management by using protocols such as telnet,
SSH, SNMP, syslog etc. Normally the Management VLAN is VLAN 1, but it can be any VLAN. It is recommended to use separate VLAN
for management traffic. Management VLANs can help to improve security by isolating management traffic from other types of traffic.
5. Native VLAN: The native VLAN is often used in IEEE 802.1Q trunk links. It is a special type of trunk VLAN. Native VLANs are used to
carry untagged traffic on a trunk link. Untagged traffic is traffic that does not belong to any specific VLAN. Native VLANs are typically
configured as VLAN 1.
VLAN Ranges
The IEEE 802.1Q standard specifies a range of 0 to 4095 VLAN IDs (total 4096 VLANs). These VLANs are organized into several ranges-
2-1001 Normal For Ethernet VLANs. Can be created, used and deleted.
1002-1005 Reserved/Normal Defaults for FDDI and Token Ring. Should not be used and cannot be
deleted
1006-4094 Extended For Ethernet VLANs. Can be created, used and deleted
Switchport Modes
There are mainly two switchport modes-
1. Access Mode: Configured to carry traffic for a single VLAN. The switch removes the VLAN tag from all frames received on the port
and forwards the frames to the switch's MAC address table. In access mode, the switch port is configured to connect end-user devices
like computers, printers, and IP phones. The port belongs to a single VLAN, and all traffic on the port is untagged and associated with
that VLAN. That’s why it’s called an access port, it gives the end hosts access to the network.
2. Trunk Mode: Configured to carry traffic for multiple VLANs. The switch preserves the VLAN tag on all frames received on the port
and forwards the frames to the appropriate switchport or router interface based on the VLAN tag. Trunk ports are essential for inter-
switch communication, as they can carry tagged frames representing different VLANs. The most common standard for VLAN tagging is
IEEE 802.1Q. There is another VLAN tagging protocol named Inter-Switch Link (ISL) which is a Cisco Proprietary. ISL doesn’t support
native VLANs. That’s why it is not used in today’s networks.
Basic Configuration
***This lab/topology was
created in GNS3 2.2.43
***Routers: Cisco Catalyst
7200 Series Router
***Switches: i86bi Linux
L3 Cisco IOS Version
15.1
***PCs: GNS3 Default
VPCS
• By default all the interface of a switch belongs to Default
VLAN 1. Use this command to check-
‘SW# show vlan brief’
Basic Configuration
• Create VLAN using following commands-
‘SW# configure terminal’
‘SW(config)# vlan <VLAN ID>’
‘SW(config-vlan)# name <VLAN name>’
Basic Configuration
• Configuring switchport mode in the up-links-
‘SW(config)# switchport interface <interface ID>’
‘SW(config-if)# switchport trunk encapsulation <dot1q>’
‘SW(config-if)# switchport mode <trunk>’
‘SW(config-if)# switchport trunk allowed vlan <VLAN IDs>’
Encapsulation is the process of adding a header and trailer to a frame in order to prepare it for transmission over a network. The
encapsulation header contains information about the frame, such as the source and destination MAC addresses, the VLAN ID (if VLANs are
being used), and the type of traffic. The encapsulation trailer contains information about the end of the frame, such as a checksum.
Layer 2 switches do not need to encapsulate frames because they are only transmitting frames within the same network segment. Layer
2 switches use the MAC address tables to forward frames to the correct destination devices.
I have used Multilayer switches in the topology, that’s why I have used ‘switchport trunk encapsulation dot1q’ command before
configuring switchport mode to trunk. We will learn about encapsulation in details in later slides In Sha Allah. Just remember for now, in case
of Layer 2 switches like C2960, this command is not needed.
Basic Configuration
• Configuration on Switch 2- • Configuration on PCs-
Basic Configuration
• SW1 VLAN information- • SW2 VLAN information-
Inter-VLAN Routing
VLANs have been created. PCs from same VLAN can ping each
other, but cannot ping end devices in different VLAN. Inter-VLAN
Routing must be enabled to ping/reach end devices on other
VLANs. Gateway of VLAN 10, 20 and 30 will be on SW2. SW2 is
a Layer 3 or Multilayer Switch.
Router-On-A-Stick (ROAS)
Gateway of VLAN 10, 20 and 30 is on the router. So, we have to configure Router-On-A-Stick to route between VLANs.
• To enable Inter-VLAN Routing on a router-
‘RTR(config)# ip routing’
Router-On-A-Stick (ROAS)
We have done Inter-VLAN Routing, still VLAN 10 and 20 cannot
ping their gateway, though PCs from VLAN 30 can ping its
gateway. Can you tell why??
Now, VLAN 10, 20 and 30 has been created in SW2, but SW doesn’t have to know about VLAN 30 although PCs from these VLAN can ping
each other. WHY?? Think of yourself!
Router-On-A-Stick (ROAS)
• SW2 VLAN information-
• Now PCs from every VLANs can ping each other. First ping is
lost because of ARP requests to know the MAC addresses.
Router-On-A-Stick (ROAS)
• Interfaces and sub-interfaces of R1-
Advantages-
• Only one LAN connection is required for multiple VLANs.
• The number of VLANs are not limited.
Disadvantages-
• Single point of failure and the network depends upon that single
• Route table of R1
link.
• Congested as the trunk link is limited by the speed of the router
interface.
• Adds Latency and Delay.
• Not Scalable
[Link] [Link]
[Link] [Link]
Fa0/0 Fa0/1
Fa1/0 Fa1/0
Fa0/0 Fa0/1
Fa1/1 Fa1/1
[Link] [Link]
V10- [Link]/24 V20- [Link]/24
IEEE 802.1Q
Switches will ‘tag’ all frames that they send over a trunk link. This allows the receiving switch to know which VLAN the frame belongs to.
• Trunk ports are tagged ports.
• Access ports are untagged ports.
The 802.1Q tag is inserted between the source and type/length fields of the Ethernet frame. The tag is 4 bytes (32 bits) in length.
The tag consists of two main fields-
• Tag Protocol Identifier (TPID)
• Tag Control Information (TCI) Preamble SFD Destination Source 802.1Q Type Data FCS
All the fields are discussed below:
• TPID: Always set to a value of 0x8100. This indicates that the
frame is 802.1Q tagged. ‘0x’ defines hexadecimal value.
• PCP: Priority Code Point- used for Class of Service (CoS),
16 bits 3 bits 1 bit 12 bits
which prioritizes important traffic in congested networks.
TCI
• DEI: Drop Eligible Indicator- used to indicate frames that can TPID
PCP DEI VID
be dropped if the network is congested.
• VID: VLAN ID- identifies the VLAN the frame belongs to. It
is 12 bits in length = 4096 total VLANs (2^12), range 0 to 4095.
Native VLAN
• 802.1Q has a feature called the native VLAN, ISL does not have this feature.
• A native VLAN is a special VLAN that is used to carry untagged traffic on a trunk port. Untagged traffic is traffic that does not belong to
any specific VLAN.
• Native VLANs are typically configured as VLAN 1 by default on all trunk ports, however this can be manually configured on each trunk
port.
• The switch does not add an 802.1Q tag to frames in the native VLAN. When a switch receives an untagged frame on a trunk port, it
assumes the frame belongs to the native VLAN.
• It is very important that the native VLAN matches.
• For security purposes, it is best to change the native VLAN to an unused VLAN.
Native VLAN
• Commands for configuring Native VLAN on trunk ports- • We are making VLAN 20 as native VLAN in the topology.
Native VLAN
• Commands for configuring ROAS for native vlan-
‘RTR(config)# interface <interface no>’
‘RTR(config-if)# ip address <gateway ip of native VLAN>’
• OR,
‘RTR(config)# interface <interface no>’
‘RTR(config-if)# encapsulation dot1q <native VLAN ID> native’
Native VLAN
• ICMP packet captured in Wireshark
of PC1 from VLAN 10 pinging PC4
from VLAN 30
Native VLAN
• ICMP packet captured in Wireshark
of PC3 from Native VLAN 20 pinging
PC5 from VLAN 30
When two switches receive DTP messages from each other, they will negotiate the trunking mode and encapsulation type. If the switches
cannot agree on a trunking mode or encapsulation type, the ports will be configured as access ports. DTP is enabled by default on all Cisco
switch interfaces.
SW1 Administrative SW2 Administrative • DTP will not form a trunk with a router, end
Operational Mode
Mode Mode devices like PC, etc.
• If one switch is configured as 802.1Q, the other switch will also select 802.1Q in auto negotiation-