Implementing VLAN Security.

Presentation_ID © 2008 Cisco Systems, Inc. All rights reserved. Cisco Confidential 1
 Overview Of VLANs
VLAN Definitions
 VLAN (virtual LAN) is a logical partition of a layer 2
network
 Multiple partition can be created, allowing for multiple
VLANs to co-exist
 Each VLAN is a broadcast domain, usually with its own
IP network
 VLANS are mutually isolated and packets can only
pass between them through a router
 The partitioning of the layer 2 network takes inside a
layer 2 device, usually a switch.
 The hosts grouped within a VLAN are unaware of the
VLAN’s existence
Presentation_ID © 2008 Cisco Systems, Inc. All rights reserved. Cisco Confidential 2
 Overview Of VLANs
VLAN Definitions

Presentation_ID © 2008 Cisco Systems, Inc. All rights reserved. Cisco Confidential 3
 Overview Of VLANs
Benefits of VLANs
 Security: Groups that have sensitive data are
separated from the rest of the network, decreasing the
chances of confidential information breaches.
 Cost reduction: Cost savings result from reduced need
for expensive network upgrades and more efficient use
of existing bandwidth and uplinks.
 Better performance: Dividing flat Layer 2 networks into
multiple logical workgroups (broadcast domains)
reduces unnecessary traffic on the network and boosts
performance

Presentation_ID © 2008 Cisco Systems, Inc. All rights reserved. Cisco Confidential 4
  Shrink broadcast domains: Dividing a network into VLANs
reduces the number of devices in the broadcast domain
 Improved IT staff efficiency: VLANs make it easier to
manage the network because users with similar network
requirements share the same VLAN.
 Simpler project and application management: VLANs
aggregate users and network devices to support business
or geographic requirements

Presentation_ID © 2008 Cisco Systems, Inc. All rights reserved. Cisco Confidential 5
Presentation_ID © 2008 Cisco Systems, Inc. All rights reserved. Cisco Confidential 6
 Overview Of VLANs
Types of VLANs
Data VLAN
 A data VLAN is a VLAN that is configured to carry user-
generated traffic.
 A data VLAN, is sometimes referred to as a user VLAN.
Default VLAN:
 All switch ports become a part of the default VLAN after
the initial boot up of a switch loading the default
configuration.
 The default VLAN for Cisco switches is VLAN 1.

Presentation_ID © 2008 Cisco Systems, Inc. All rights reserved. Cisco Confidential 7
 Native VLAN:
 A native VLAN is assigned to an 802.1Q trunk port.
Trunk ports are the links between switches that support
the transmission of traffic associated with more than
one VLAN.
 An 802.1Q trunk port supports traffic coming from many
VLANs (tagged traffic), as well as traffic that does not
come from a VLAN (untagged traffic).

Presentation_ID © 2008 Cisco Systems, Inc. All rights reserved. Cisco Confidential 8
 Management VLAN
 A management VLAN is any VLAN configured to
access the management capabilities of a switch.
 VLAN 1 is the management VLAN by default.
 To create the management VLAN, the switch virtual
interface (SVI) of that VLAN is assigned an IP address
and subnet mask, allowing the switch to be managed
via HTTP, Telnet, SSH, or SNMP

Presentation_ID © 2008 Cisco Systems, Inc. All rights reserved. Cisco Confidential 9
 Overview Of VLANs
Types of VLANs

Presentation_ID © 2008 Cisco Systems, Inc. All rights reserved. Cisco Confidential 10
 VLANs in a Multi-Switched Environment
VLAN Trunks
 A VLAN trunk carries more than one VLAN
 Usually established between switches so same-VLAN
devices can communicate even if physically connected
to different switches
 A VLAN trunk is not associated to any VLANs.
Neither is the trunk ports used to establish the trunk link
 Cisco IOS supports IEEE 802.1q, a popular VLAN trunk
protocol

Presentation_ID © 2008 Cisco Systems, Inc. All rights reserved. Cisco Confidential 11
VLANs in a Multi-Switched Environment
VLAN Trunks

Presentation_ID © 2008 Cisco Systems, Inc. All rights reserved. Cisco Confidential 12
 VLAN Assignment
Creating a VLAN

Presentation_ID © 2008 Cisco Systems, Inc. All rights reserved. Cisco Confidential 13
 VLAN Assignment
Assigning Ports To VLANs

Presentation_ID © 2008 Cisco Systems, Inc. All rights reserved. Cisco Confidential 14
 VLAN Assignment
Assigning Ports To VLANs

Presentation_ID © 2008 Cisco Systems, Inc. All rights reserved. Cisco Confidential 15
 VLAN Assignment
Changing VLAN Port Membership

Presentation_ID © 2008 Cisco Systems, Inc. All rights reserved. Cisco Confidential 16
 VLAN Assignment
Changing VLAN Port Membership

Presentation_ID © 2008 Cisco Systems, Inc. All rights reserved. Cisco Confidential 17
 VLAN Assignment
Deleting VLANs

Presentation_ID © 2008 Cisco Systems, Inc. All rights reserved. Cisco Confidential 18
 VLAN Assignment
Verifying VLAN Information

Presentation_ID © 2008 Cisco Systems, Inc. All rights reserved. Cisco Confidential 19
 VLAN Assignment
Verifying VLAN Information

Presentation_ID © 2008 Cisco Systems, Inc. All rights reserved. Cisco Confidential 20
 VLAN Assignment
Configuring IEEE 802.1q Trunk Links

Presentation_ID © 2008 Cisco Systems, Inc. All rights reserved. Cisco Confidential 21
 VLAN Assignment
Resetting the Trunk To Default State

Presentation_ID © 2008 Cisco Systems, Inc. All rights reserved. Cisco Confidential 22
 VLAN Assignment
Resetting the Trunk To Default State

Presentation_ID © 2008 Cisco Systems, Inc. All rights reserved. Cisco Confidential 23