As you have already seen, a switch breaks a collision domain. Taken a step further, a router breaks a Broadcast domain, which means a network would look something like the following figure:
Figure 2.13 – Routers Separate Broadcast Domains
Before we continue, let’s discuss what a LAN really is. A LAN is essentially a Broadcast domain. In the network shown in Figure 2.13, if PC-A sends a Broadcast, it will be received by PC-B but not by PC-C or PC-D. This is because the router breaks the Broadcast domain. Now you can use virtual LANs (VLANs) to put switch ports into different Broadcast domains, as illustrated in the figure below:
Figure 2.14 – Broadcast Domains with VLAN
In Figure 2.14, the Layer 2 network has been divided into two Broadcast domains using VLANs. Now a Broadcast sent by PC-A will be received by PC-B but not by PC-C and PC-D. Without VLANs PC-C and PC-D would have received the Broadcasts sent by PC-A. The following are some advantages of VLANs:
- Containing Broadcasts within a smaller group of devices will make the network faster.
- Saves resources on devices because they process less Broadcasts.
- Added security by keeping devices in a certain group (or function) in a separate Broadcast domain. A group, as implied here, can mean department, security level, etc. For example, devices belonging to a development or testing lab should be kept separate from the production devices.
- Flexibility in expanding a network across a geographical location of any size. For example, it does not matter where in the building a PC is. It thinks it is on the same segment of the network as any other PC configured to be in the same VLAN. In Figure 2.15 below, all hosts in VLAN 1 can talk to each other, even though they are on different floors. The VLAN is transparent or invisible to them.
Figure 2.15 – VLANs Remove the Physical Boundaries from a LAN
VLAN Marking
Although vendors used individual approaches to create VLANs, a multi-vendor VLAN must be carefully handled to deal with interoperability issues. For example, Cisco developed the ISL standard that operates by adding a new 26-byte header, plus a new 4-byte trailer, encapsulating the original frame. To solve incompatibility problems, IEEE developed 802.1Q, a vendor-independent method to create interoperable VLANs.
Figure 2.16 – ISL Marking Method
802.1Q is often referred to as frame tagging because it inserts a 32-bit header, called a “tag,” into the original frame, after the Source Address field, without modifying other fields. The next 2 bytes after the Source Address field hold a registered Ethernet type value of 0x8100, which implies the frame contains an 802.1Q header. The next 3 bits represent the 802.1P User Priority field and are used as Class of Service (CoS) bits in Quality of Service (QoS) techniques. The next subfield is a 1-bit Canonical Format Indicator, followed by the VLAN ID (12 bits). This gives us a total of 4096 VLANs when using 802.1Q.
Figure 2.17 – 802.1Q Marking Method
A port that carries data from multiple VLANs is called a trunk. It can use either the ISL or the 802.1Q protocols. A special concept in the 802.1Q world is “native VLAN.” This is a particular type of VLAN in which frames are not tagged. The native VLAN’s purpose is to allow a switch to use 802.1Q trunking (multiple VLANs on a single link) on an interface, but if the other device does not support trunking, the traffic for the native VLAN can still be sent over the link. If a switch receives any untagged traffic over a trunk link, it will assume it is destined for the native VLAN. Cisco uses VLAN 1 as the default native VLAN.
VLAN Membership
There are two common ways to associate ports with VLANs – statically or dynamically.
With static VLAN assignment or configuration, the ports on the switch are configured by the network administrator to be in different VLANs, and the relevant device is then connected to the port. If the user needs to move to another part of the building, this will require the administrator to change the configuration on the switch. All switch ports belong to VLAN 1 by default.
Dynamic VLAN assignment allows devices to join a specific VLAN based on the MAC address of the device. This gives the administrator the flexibility to allow users to connect to any switch or move around the building without having to change the configuration on the switch. This is achieved using a VLAN Management Policy Server (VMPS).
Farai says – “Ports are assigned to VLANs and devices are connected to ports.”
Please note that since each VLAN is a different Broadcast domain, this means:
- Hosts in one VLAN cannot reach hosts in another VLAN, by default
- A Layer 3 device is needed for inter-VLAN communication (this will be covered later)
- Each VLAN needs its own subnet, for example, VLAN 1 – 192.168.1.0/24, VLAN 2 – 192.168.2.0/24
- All hosts in a VLAN should belong to the same subnet
VLAN Links
We know that one switch can have hosts connected to multiple VLANs. But what happens when traffic goes from one host to another? For example, in Figure 2.15 above, when the host in VLAN 1 on Floor 1 tries to reach the host in VLAN 1 on Floor 2, how will the switch on Floor 2 know which VLAN the traffic belongs to?
Switches use a mechanism called “frame tagging” to keep traffic on different VLANs separate. The switch adds a header on the frame, which contains the VLAN ID. In Figure 2.15, the switch on Floor 1 will tag the traffic originating from VLAN 2 and pass it to Switch 2, which will see the tag and know that the traffic needs to be kept within that VLAN. Such tagged traffic can only flow across special links called trunk links. VLAN 1 is usually designated as the native VLAN and traffic on the native VLAN is not tagged. We will cover native VLANs in more detail later.
Switch ports (within the scope of the CCNA exam) can be divided into the following:
- Access links or ports
- Trunk links or ports
- Dynamic (this will be discussed shortly)
Access Links
A switch port, which is defined as an access link, can be a member of only one VLAN. The device connected to the access link is not aware of the existence of any other VLANs. The switch will add a tag to a frame as it enters an access link from the host and remove the tag when a frame exits the switch access link towards the host. Access links are used to connect to hosts, but they can also be used to connect to a router. Trunk links are covered in the following section.
Trunking
A switch port usually will connect either to a host on the network or to another network switch, router, or server. If this is the case, then the link may need to carry traffic from several VLANs. In order to do this, each frame needs to identify which VLAN it is from. This identification method is known as frame tagging, and all frames are tagged before passing over the trunk link, apart from the native VLAN. The tag in the frame contains the VLAN ID. When the frame reaches the switch where the destination host resides, the tag is removed.
Figure 2.18 – VLAN Tagging
VLAN trunks are used to carry data from multiple VLANs. To differentiate one VLAN frame from another, all frames sent across a trunk link are specially tagged so that the destination switch knows which VLAN the frame belongs to. ISL and 802.1Q are the two primary encapsulation methods which can be used to ensure that VLANs that traverse a switch trunk link can be uniquely identified.
ISL is Cisco proprietary; however, the model tested in the CCNA exam is the 2960 switch, which only recognises 802.1Q. We cover it here for completeness and in case you have to configure an older switch model.
Farai says – “All new switches now default to 802.1Q. ISL is being deprecated.”
802.1Q differs from ISL in several ways. The first significant difference is that 802.1Q supports up to 4096 VLANs, whereas ISL supports up to 1000. Another significant difference is that of the native VLAN concept used in 802.1Q. By default, all frames from all VLANs are tagged when using 802.1Q. The only exception to this rule is frames that belong to the native VLAN, which are not tagged.
However, keep in mind that it is possible to specify which VLAN will not have frames tagged by specifying that VLAN as the native VLAN on a particular trunk link. For example, to prevent tagging of frames in VLAN 400 when using 802.1Q, you would configure that VLAN as the native VLAN on a particular trunk. IEEE 802.1Q native VLAN configuration will be illustrated in detail later.
The following summarises some features of 802.1Q:
- Supports up to 4096 VLANs
- Uses an internal tagging mechanism, modifying the original frame
- Open standard protocol developed by the IEEE
- Does not tag frames on the native VLAN; however, all other frames are tagged
The following is a short sample configuration of a switch. I have included the switchport command, which tells the switch to act as a switch port for Layer 2, as opposed to Layer 3.
Sw(config)#interface FastEthernet 0/1
Sw(config-if)#switchport
Sw(config-if)#switchport mode trunk
Sw(config-if)#switchport trunk encapsulation dot1q
Sw(config-if)#exit
Of course, on a 2960 switch, the encapsulation command won’t be recognised because there is only one type available. You will need to set the interface as a trunking interface when connecting to another switch to allow VLANs to be tagged. The same thing goes for the switchport command. Again, I cover this because in the real world you may well have to configure a Layer 3 switch, and if we stuck strictly to the 2960 model, you may become confused, which we don’t want!
A trunk link on a switch can be in one of five possible modes:
- On – forces the port into permanent trunking mode. The port becomes a trunk, even if the connected device does not agree to convert the link into a trunk link.
- Off – the link is not used as a trunk link, even if the connected device is set to “trunk.”
- Auto – the port is willing to become a trunk link. If the other device is set to “on” or “desirable,” then the link becomes a trunk link. If both sides are left as “auto,” then the link will never become a trunk, as neither side will attempt to convert.
- Desirable – the port actively tries to convert to a trunk link. If the other device is set to “on,” “auto,” or “desirable,” then the link will become a trunk link.
- No-negotiate – prevents the port from negotiating a trunk connection. It will be forced into an access or trunk mode as per the configuration.
Configuring VLANs
Now that you understand VLANs and trunk links, let’s configure the network shown in Figure 2.19 below. You will need to configure the switches such that the hosts on fa0/1 are in VLAN 5 and the link on port fa0/15 is a trunk link.
Figure 2.19 – Test Network
Before assigning ports to VLANs, the VLAN itself must be created using the vlan <vlan#> global configuration command. This will put you into vlan Configuration mode, where a descriptive name can be given to the VLANs. Here is an example:
Switch1(config)#vlan 5
Switch1(config-vlan)#name RnD
Switch2(config)vlan 5
Switch2(config-vlan)#name RnD
To see which VLANs exist on a switch, use the show vlan command. The output will be similar to the one below:
| Switch1#show vlan | |||||
|
VLAN |
Name |
Status |
Ports |
||
|
—- |
——– |
——- |
——————————————– |
||
|
1 |
default |
active |
Fa0/1, Fa0/2, Fa0/3, Fa0/4 Fa0/5, Fa0/6, Fa0/7, Fa0/8 Fa0/9, Fa0/10, Fa0/11, Fa0/12, Fa0/13 Fa0/14, Fa/15, Fa0/16, Fa0/17, Fa0/18 |
||
|
… [Truncated Output] … |
|||||
|
5 |
RnD |
active |
|||
|
… [Truncated Output] |
|||||
| Let’s assign port fa0/1 to VLAN 5 using the switchport access vlan [vlan#] interface configuration command: | |||||
|
Switch1(config)#int fa0/1 |
|||||
|
Switch1(config-if)#switchport access vlan 5 |
|||||
|
Switch2(config)#int fa0/1 |
|||||
| On a Layer 3-capable switch, such as the 3560, you would have to set the port manually to access it with the switchport mode access command before putting it into a VLAN. Now let’s look at the output for the show vlan command: | |||||
|
Switch1#show vlan |
|||||
|
VLAN |
Name |
Status |
Ports |
||
|
—- |
—- |
—– |
——————————————– |
||
|
1 |
default |
active |
Fa0/2, Fa0/3, Fa0/4, Fa0/5, Fa0/6, Fa0/7, Fa0/8, Fa0/9, Fa0/10, Fa0/11, Fa0/12, Fa0/13, Fa0/14, Fa/15, Fa0/16, Fa0/17, Fa0/18 |
||
|
… [Truncated Output] … |
|||||
|
5 |
RnD |
active |
Fa0/1 |
||
|
… [Truncated Output] |
|||||
Note that fa0/1 is now assigned to VLAN 5. Let’s configure interface fa0/15 on both switches as trunk links. It should be noted here that the default mode on (the 3550 model) switch ports is desirable (on the 3560 model it’s auto, so check your platform notes). Dynamic Trunking Protocol (DTP) will cause fa0/15 on both switches to become ISL trunk links. We will cover DTP in the next lesson, but I wanted to mention it here briefly. This can be verified using the show interface trunk command:
| Switch1#show interface trunk | ||||
| Port | Mode | Encapsulation | Status | Native vlan |
| Fa0/15 | desirable | n-isl | trunking | 1 |
Note that the mode is desirable and the encapsulation is ISL (“n” stands for negotiated).
The following output shows how to configure the trunk to use ISL trunking:
| Switch1(config)#interface fa0/15 |
| Switch1(config-if)#switchport trunk encapsulation isl |
| Switch1(config-if)#switchport mode trunk |
| Switch2(config)#interface fa0/15 |
| Switch2(config-if)#switchport trunk encapsulation isl |
| Switch2(config-if)#switchport mode trunk |
The switchport trunk encapsulation command sets the trunking protocol on the port, and the switchport mode trunk command sets the port to trunking. The output for the show interface trunk command will now look like this:
| Switch2#show interface trunk | ||||
| Port | Mode | Encapsulation | Status | Native vlan |
| Fa0/15 | on | isl | trunking | 1 |
Note that the encapsulation is now isl instead of n-isl. This is because this time the protocol was not negotiated but configured on the interface.
Important NOTE: Trunk encapsulation needs to be configured on the switch port before setting it to trunk mode. Please note that this does not apply to switch model 2960 (currently used for the CCNA syllabus), which can only use dot1q (another name for 802.1Q) encapsulation. For this reason, the switchport trunk encapsulation command will not work on the 2960 switch.
Similarly, you can configure the switch port to use 802.1Q instead of ISL, as illustrated in the output below:
| Switch1(config)#interface fa0/15 | ||||
| Switch1(config-if)#switchport trunk encapsulation dot1q | ||||
| Switch1(config-if)#switchport mode trunk | ||||
Switch2(config)#interface fa0/15Switch2(config-if)#switchport trunk encapsulation dot1qSwitch2(config-if)#switchport mode trunk The show interface trunk output now looks like this:Switch2#show interface trunk PortModeEncapsulationStatusNative vlanFa0/15on802.1qtrunking1
Note that the native VLAN is 1. That is the default native vlan on an 802.1Q trunk and it can be changed using the switchport trunk native vlan <vlan#> command. The native VLAN of each port on the trunk must match. This command is part of the CCNA syllabus and is considered a security measure.
IMPORTANT NOTE: Switches remember all VLAN info, even when reloaded. If you want your switch to boot with a blank configuration, then you will need to issue the delete vlan.dat command on your switch, as shown in the output below. This applies to live switches only, not switch emulators such as Packet Tracer.
SwitchA#dir flash:
Directory of flash:/
1 -rw- 3058048 <no date> c2960-i6q4l2-mz.121-22.EA4.bin
2 -rw- 676 <no date> vlan.dat
64016384 bytes total (60957660 bytes free)
SwitchA#
SwitchA#delete vlan.dat
Delete filename [vlan.dat]?
Delete flash:/vlan.dat? [confirm]
SwitchA#dir flash:
Directory of flash:/
1 -rw- 3058048 <no date> c2960-i6q4l2-mz.121-22.EA4.bin
64016384 bytes total (60958336 bytes free)
SwitchA#