Virtual LAN
|
|
A virtual LAN, commonly known as a VLAN, is a logically independent network. Several VLANs can co-exist on a single physical switch. IEEE 802.1Q is the predominant protocol. Prior to the introduction of 802.1q, Cisco's ISL (Inter-Switch Link), a variant of IEEE 802.10, was one of several proprietary protocols. ISL is now deprecated in favor of 802.1q.
Early VLANs were often configured to reduce the size of the collision domain in a large single Ethernet segment to improve performance. When Ethernet switches made this a non-issue (because they have no collision domain), attention turned to reducing the size of the broadcast domain at the MAC layer. Another purpose of a virtual network is to restrict access to network resources without regard to physical topology of the network, although the strength of this method is debatable.
Virtual LANs operate at layer 2 of the OSI model. However, a VLAN is often configured to map directly to an IP network, or subnet, which gives the appearance it is involved in layer 3.
Switch to switch links and switch to router links are called trunks. A router or Layer 3 switch serves as the backbone for traffic going across different VLANs.
VLANs can be configured in various ways;
- Protocol level, IP, IPX, LAT, etc
- MAC address based.
- IP subnet based.
- Port based, and therefore real world based, say by accounting versus marketing departments.
VLANs can be static, dynamic, or port-centric and there are two methods of establishing a VLAN: frame-tagging and frame-filtering. Frame-tagging changes the information that is contained within the layer 2 frame, so that switches may forward the VLAN traffic to their correct VLAN destination and return the frame to its normal format. Frame-filtering involves the switch looking for certain criteria in the layer 2 frame and using this matching system to forward the traffic to its correct VLAN and destination.
A Layer 2 device can implement VLANs in different ways;
- Open VLANs have a single MAC address database for all VLANs.
- Closed VLANs have a separate MAC address database for each VLAN.
- Mixed Mode VLANs can be configured as Open or Closed on a VLAN basis.
Closed VLANs are generally considered more secure than Open VLANs.
On Cisco devices, VTP (VLAN Trunking Protocol) allows for VLAN domains, which can aid in administrative tasks. VTP also allows "pruning," through which specific VLAN traffic is directed only to switches which have ports on that VLAN.
External links
- IEEE's 802.1Q standard (http://standards.ieee.org/getieee802/download/802.1Q-1998.pdf)
- Cisco's Virtual LAN Communications white paper (http://www.cisco.com/warp/public/cc/pd/wr2k/cpbn/tech/vlan_wp.htm)
- Cisco's Bridging Between IEEE 802.1Q VLANs white paper (http://www.cisco.com/univercd/cc/td/doc/product/software/ios121/121newft/121t/121t3/dtbridge.htm)
- University of California's VLAN Information (http://net21.ucdavis.edu/newvlan.htm)da:VLAN
de:VLAN fr:Virtual LAN he:רשת מקומית וירטואלית ja:Virtual Local Area Network pl:Sieć wirtualna