Chapter 2

VLAN Networks
Module Switched Networks
3rd Year
2021/2022

1
Part 1
Overview of VLANs

2
 Local Area Network (LAN)
 A set of communicating entities
belonging to the same organization or
Enterprise.
 The enterprise usually consists of
different departments, services, teams,
etc.
 All machines share the same broadcast
domain

Poor exploitation of resources.

Sale
Network overload resulting in low IT RH
s
throughput.
Risk of network congestion due to
multiple broadcasts.
A Single Broadcast Domain
3
 LAN Segmentation (1/2)
Objective: To create multiple broadcast
domains to reduce network overload and
RH
improve network performance.
Solution 1 : Physical Segmentation

 How: Replace switches by routers with a IT

redistribution of machines by services,
department, team.

Requirement for physical grouping of

employees.
Sale
Increase the cost of setting up the network. s Sale
It is not the role of the router to interconnect IT RH
s
several segments of the same network.
It is no longer a single LAN!

Three Broadcast Domains

4
 LAN Segmentation (2/2)
Objective: To create multiple broadcast domains to
reduce network overload and improve network
performance.
Solution 2 : Logical Segmentation

The VLANs
Virtual Local Area Network

 How: Configuration of switches

without the need for physical
grouping of machines.

VLAN = separate broadcast

domain VLA VLA
VLAN
N N
More flexibility in terms of IT
Sales RH
machine layout.
Keep the same architecture
Trois domaines de diffusion
5
 VLAN Definition
 VLANs are logical connections between devices in the same broadcast domain
with the same grouping purpose.

 Placing devices into various VLANs have the following characteristics:

• Provides segmentation of the various groups of devices on the same switches
• Provide organization that is more manageable
• Broadcasts, multicasts and unicasts are isolated in the individual VLAN
• Each VLAN will have its own unique range of IP addressing
• Smaller broadcast domains

6
 Benefits of a VLAN Design

 Benefits of using VLANs are

as follows:

Benefits Description
Smaller Broadcast Domains Dividing the LAN reduces the number of broadcast domains
Improved Security Only users in the same VLAN can communicate together
Improved IT Efficiency VLANs can group devices with similar requirements, e.g. faculty vs. students

Reduced Cost One switch can support multiple groups or VLANs

Better Performance Small broadcast domains reduce traffic, improving bandwidth
Simpler Management Similar groups will need similar applications and other network resources

7
 Types of VLAN (1/3)
 Default VLAN
• If no VLANs are configured, all ports on a switch belong to the default VLAN.
• The default VLAN for Cisco switches is VLAN 1.
 Data VLAN
• Dedicated to user-generated traffic (email and web traffic).
• VLAN 1 is the default data VLAN because all interfaces are assigned to this VLAN .
 Native VLAN
• This is used for trunk links only.
• All frames are tagged on an 802.1Q trunk link except for those on the native VLAN.
 Management VLAN
• This is used for SSH/Telnet VTY traffic and should not be carried with end user traffic.
• Typically, the VLAN that is the SVI for the Layer 2 switch.

8
 Types of VLAN (2/3)
 Voice VLAN
• A separate VLAN is required because Voice traffic
requires:
 Assured bandwidth
 High QoS priority
 Ability to avoid congestion
 Delay less that 150 ms from source to
destination
• The entire network must be designed to support voice.

9
 Types of VLAN (3/3)
 Default VLAN : VLAN 1
• The default Native VLAN
• Default Management VLAN
• Can not be deleted or renamed

Vlan 1 is All ports are

the Default assigned to vlan 1
VLAN by default

10
Part 2
VLAN Configuration

11
 VLAN Ranges
 Catalyst switches 2960 and 3650 support
over 4000 VLANs.

Normal Range VLAN 1 – 1005 Extended Range VLAN 1006 - 4095

Used in Small to Medium sized businesses Used by Service Providers
1002 – 1005 are reserved for legacy VLANs Are in Running-Config
1, 1002 – 1005 are auto created and cannot be Supports fewer VLAN features
deleted
Stored in the vlan.dat file in flash Requires VTP configurations
VTP can synchronize between switches

12
 VLAN Creation Commands
 VLAN details are stored in the vlan.dat file. You create VLANs in the global
configuration mode.

Task IOS Command

Enter global configuration mode. Switch# configure terminal
Create a VLAN with a valid ID number.
Switch(config)# vlan vlan-id
(Mandatory)
Specify a unique name to identify the VLAN.
Switch(config-vlan)# name vlan-name
(Optional)
Switch(config-vlan)# end
Return to the privileged EXEC mode. Or
Ctrl-z
Enter global configuration mode. Switch# configure terminal

13
 VLAN Creation Example
• If the Student PC is going to be in VLAN
20, we will create the VLAN first and
then name it.
 If you do not name it, the Cisco IOS will
give it a default name, the four digit
number of the VLAN.
For example : vlan0020 for VLAN 20
Prompt Commande
S1# Configure terminal
S1(config)# vlan 20
S1(config-vlan)# name student
S1(config-vlan)# end

14
 Checking the creation of VLANs
 You can check that the vlan has been created using the following command:
Switch# show vlan brief

15
 Verify VLAN Information
 Use the show vlan command. The complete syntaxe is:
Switch# show vlan [brief | id vlan-id | name vlan-name ]

Task Command Option

Display VLAN name, status, and its ports one VLAN per line. brief

Display information about the identified VLAN ID number. id vlan-id

Display information about the identified VLAN name. The vlan-name is an ASCII string
name vlan-name
from 1 to 32 characters.

16
 Port Assignment (Access Mode)

Access Mode:
A port in "access"
mode is a port that
belongs to a single
vlan

17
 VLAN Port Assignment Commands
 Once the VLAN is created, we can then assign it to the correct interfaces.

Task Command
Enter global configuration mode. Switch# configure terminal

Enter interface configuration mode. Switch(config)# interface interface-id

Set the port to access mode. Switch(config-if)# switchport mode access

Assign the port to a VLAN. Switch(config-if)# switchport access vlan vlan-id

Return to the privileged EXEC mode. Switch(config-if)# end

18
 VLAN Port Assignment Example
 We can assign the port interface to the
VLAN.
• Once the device is assigned the VLAN,
then the end device will need the IP
address information for that VLAN
• Here, Student PC receives 172.17.20.22
Prompt Command
S1# Configure terminal
S1(config)# Interface fa0/18
S1(config-if)# Switchport mode access
S1(config-if)# Switchport access vlan 20
S1(config-if)# end

19
 Checking VLAN Port Assignment
 You can check that the port has been assigned to the correct VLAN by using the :
Switch# show vlan brief

20
 Change VLAN Port Membership

 There are a number of ways to change

VLAN membership:
• Option 1 : re-enter switchport access vlan
vlan-id command
• Option 2 : use the no switchport access vlan
to place interface back in VLAN 1
 Use the show vlan brief or the show
interface fa0/18 switchport commands to
verify the correct VLAN association.

21
Part 3
VLAN Trunks

22
 Ports Assignment (Trunk mode)

Access Mode: Trunk Mode :

A port in "access" A trunk port can
mode is a port that carry traffic from
belongs to a single different vlans
vlan

23
 Defining VLAN Trunk
 A trunk is a point-to-point link between two network devices.

 Cisco trunk functions:

• Allow more than one VLAN
• Extend the VLAN across the entire network
• By default, supports all VLANs
• Supports 802.1Q trunking

24
 VLAN Identification
 The IEEE 802.1Q header is 4 Bytes
 When the tag is created the FCS must be recalculated.
 When sent to end devices, this tag must be removed
and the FCS recalculated back to its original number.

802.1Q VLAN Tag Field Function

Type • 2-Byte field with hexadecimal 0x8100
• This is referred to as Tag Protocol ID (TPID)
User Priority • 3-bit value that supports a certain priority for flows
Canonical Format Identifier (CFI) • 1-bit value that can support token ring frames on Ethernet
VLAN ID (VID) • 12-bit VLAN identifier that can support up to 4096 VLANs
• Example: 0000 0110 0100 = VID: 100
25
 Native VLANs and 802.1Q Tagging
 802.1Q trunk basics:
• Tagging is typically done on all VLANs.
• The use of a native VLAN was designed for
legacy use, like the hub in the example.
• Unless changed, VLAN1 is the native VLAN.
• Each trunk is configured separately, so it is
possible to have a different native VLANs on
separate trunks.

Both ends of a trunk link must be configured with the same native VLAN.

26
 Trunk Configuration Command
 Configure and verify VLAN trunks. Trunks are layer 2 and carry traffic for all
VLANs
Task IOS Command
Enter global configuration mode. Switch# configure terminal

Enter interface configuration mode. Switch(config)# interface interface-id

Set the port to permanent trunking mode. Switch(config-if)# switchport mode trunk

Sets the native VLAN to something other than

VLAN 1. Switch(config-if)# switchport trunk native vlan vlan-id
Note: The Native VLAN must already be created

Specify the list of VLANs to be allowed on the trunk

Switch(config-if)# switchport trunk allowed vlan vlan-list
link.

Return to the privileged EXEC mode. Switch(config-if)# end

27
 Trunk Configuration Example
 The subnets associated with each VLAN
are:
• VLAN 10 - Faculty/Staff - 172.17.10.0/24
• VLAN 20 - Students - 172.17.20.0/24
• VLAN 30 - Guests - 172.17.30.0/24
• VLAN 99 - Native - 172.17.99.0/24 Prompt Command
S1(config)# Interface fa0/1
S1(config-if)# Switchport mode trunk
 F0/1 port on S1 is configured as a trunk
S1(config-if)# Switchport trunk native vlan 99
port.
S1(config-if)# Switchport trunk allowed vlan 10,20,30,99
S1(config-if)# end

28
 Verify Trunk Configuration
 Notice the result of the command
Switch#show interface fa0/1 switchport
• Is set to trunk administratively
• Is set as trunk operationally (functioning) On

• Encapsulation is dot1q
• Native VLAN set to VLAN 99
• All VLANs created on the switch will pass traffic
on this trunk

29
 Reset the Trunk to the Default State (1/2)

 Reset the default trunk settings with the

no command.
• All VLANs allowed to pass traffic
• Native VLAN = VLAN 1
 Verify the default settings with the
command
show interface fa0/1 switchport .

30
 Reset the Trunk to the Default State (2/2)

 Reset the trunk to an access mode with

the switchport mode access
command:
• Is set to an access interface
administratively
• Is set as an access interface operationally
(functioning)

31
 Delete VLAN
 Delete VLANs with the command no vlan vlan-id.

Caution: Before deleting a VLAN, reassign all member ports to a different VLAN.

 Delete all VLANs with the delete flash:vlan.dat or delete vlan.dat commands.
 Reload the switch when deleting all VLANs.

32
Part 4
DTP Protocol (Dynamic Trunking Protocol)

33
 Introduction to DTP protocol
 Dynamic Trunking Protocol (DTP) is a proprietary Cisco protocol.
 DTP characteristics are as follows:
• On by default on Catalyst 2960 and 2950 switches
• Dynamic-auto is default on the 2960 and 2950 switches
• May be turned off with the nonegotiate command
• May be turned back on by setting the interface to dynamic-auto
• Setting a switch to a static trunk or static access will avoid negotiation issues with the
switchport mode trunk or the switchport mode access commands.

34
 Negotiated Interface Modes
 The switchport mode command has additional options.
 Use the switchport nonegotiate interface configuration command to stop DTP
negotiation.

Option Description
Permanent access mode and negotiates to convert the neighboring link into an
Access
access link
Will becomes a trunk interface if the neighboring interface is set to trunk or
Dynamic auto
desirable mode
Actively seeks to become a trunk by negotiating with other auto or desirable
Dynamic desirable
interfaces
Permanent trunking mode and negotiates to convert the neighboring link into a
Trunk
trunk link

35
 Results of a DTP configuration
 The configuration options for the DTP protocol are:

Port1 Option
Dynamic Auto Dynamic Desirable Trunk Access
Port2 Option
Dynamic Auto Access Trunk Trunk Access

Dynamic Desirable Trunk Trunk Trunk Access

Trunk Trunk Trunk Trunk Limited Connectivity

Access Access Access Limited Connectivity Access

36
 Example of DTP configuration (1/3)
 By Default

37
 Example of DTP configuration (2/3)
 Configuration of the F0/1 interface of switch S2 in dynamic desirable mode :

 Checking the configuration :

38
 Example of DTP configuration (3/3)
 Checking the port mode :

39
End chapter 2

40